CVE Intelligence

Dlink vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Dlink products: 408 record(s), with severity, exploitation and fixes.

Dir-513 Firmware 39DNS-340L 32DNS-320 32Dns-320 Firmware 29DNS-327L 28Di-8003 Firmware 28DNS-320L 27Dir-600l Firmware 27DNS-345 27Dir-823x Firmware 26DIR-823X 25Dns-343 Firmware 25DNS-325 25Dns-320l Firmware 24Dns-120 Firmware 24Dnr-202l Firmware 24Dns-315l Firmware 24Dns-320lw Firmware 24Dns-321 Firmware 24Dns-323 Firmware 24Dns-325 Firmware 24Dns-326 Firmware 24Dns-327l Firmware 24Dnr-326 Firmware 24Dns-340l Firmware 24Dns-345 Firmware 24Dns-726-4 Firmware 24Dns-1100-4 Firmware 24Dns-1200-05 Firmware 24Dns-1550-04 Firmware 24DNR-326 23DNS-1100-4 23DNS-326 23DNS-315L 23DNR-202L 23DNS-120 23DNS-320LW 23DNR-322L 23DNS-321 23DNS-323 23

Exploited only (KEV) →

CVE-2026-4195 Critical · 9.8 CWE-77 Mar 16, 2026
D-Link DNS-1550-04 wizard_mgr.cgi command injection
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown function of the file /cgi-bin/wizard_mgr.cgi. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-4194 Critical · 9.8 CWE-266 Mar 16, 2026
D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file /cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2026-4193 High · 7.5 CWE-266 Mar 16, 2026
D-Link DIR-823G goahead UpdateClientInfo access control
A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSettings/GetDMZSettings/GetFirewallSettings/GetGuestNetworkSettings/GetLanWanConflictInfo/GetLocalMacAddress/GetNetworkSettings/GetQoSSettings/GetRouterInformationSettings/GetRouterLanSettings/GetWanSettings/SetAccessCtlList/SetAccessCtlSwitch/SetDeviceSettings/SetGuestWLanSettings/SetIPv4FirewallSettings/SetNetworkSettings/SetNetworkTomographySettings/SetNTPServerSettings/SetRouterLanSettings/SetStaticClientInfo/SetStaticRouteSettings/SetWLanRadioSecurity/SetWPSSettings/UpdateClientInfo of the component goahead. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4188 High · 8.8 CWE-119 Mar 16, 2026
D-Link DIR-619L boa formSchedule stack-based overflow
A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4184 Critical · 9.8 CWE-787 Mar 16, 2026
D-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflow
A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/form2Wl5BasicSetup.cgi of the component goahead. Performing a manipulation of the argument pskValue results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4183 Critical · 9.8 CWE-787 Mar 16, 2026
D-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflow
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4182 Critical · 9.8 CWE-787 Mar 16, 2026
D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow
A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4181 Critical · 9.8 CWE-787 Mar 16, 2026
D-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflow
A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4180 Critical · 9.8 CWE-266 Mar 16, 2026
D-Link DIR-816 goahead redirect.asp access control
A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The manipulation of the argument token_id leads to improper access controls. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-70245 Critical · 9.8 CWE-787 Mar 12, 2026
Out-of-bounds Write in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.
CVE-2026-3978 High · 8.8 CWE-119 Mar 12, 2026
D-Link DIR-513 formEasySetupWizard3 stack-based overflow
A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. The manipulation of the argument wan_connected results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2025-70244 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanSetup.
CVE-2025-70251 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formWlanGuestSetup.
CVE-2025-70249 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard2.
CVE-2025-70247 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard1.
CVE-2025-70246 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formVirtualServ.
CVE-2025-70242 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formSetWanPPTP.
CVE-2025-70227 High · 7.5 CWE-121 Mar 10, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the nextPage parameter to goform/formLanguageChange.
CVE-2025-70250 High · 7.5 CWE-121 Mar 9, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formdumpeasysetup.
CVE-2025-70243 High · 7.5 CWE-121 Mar 9, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.
CVE-2025-70238 High · 7.5 CWE-121 Mar 9, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard52.
CVE-2025-29165 Critical · 9.8 CWE-269 Mar 5, 2026
Improper Privilege Management in Dlink Dir-1253 Firmware
An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component
CVE-2025-70233 Critical · 9.8 CWE-121 Mar 5, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetEnableWizard.
CVE-2025-70232 Critical · 9.8 CWE-121 Mar 5, 2026
Stack-based Buffer Overflow in Dlink Dir-513 Firmware
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.
CVE-2025-70231 Critical · 9.8 CWE-22 Mar 5, 2026
Path Traversal in Dlink Dir-513 Firmware
D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability.