Which versions of D-Link are affected by CVE-2026-4627?

D-Link DIR-825 and DIR-825R routers contain a critical command injection vulnerability affecting authenticated administrators, with no vendor patch available due to end-of-life status.

How to fix or mitigate CVE-2026-4627?

Within 24 hours: Inventory all DIR-825 and DIR-825R routers in production and document their network locations and criticality. Within 7 days: Implement network segmentation to isolate affected routers and restrict administrative access to trusted networks only; disable NTP service configuration features if not essential. Within 30 days: Develop a hardware replacement plan to decommission these end-of-life devices and migrate to supported equipment with active security patching.

D-Link CVE-2026-4627

Q: What is the CVSS score of CVE-2026-4627?

CVE-2026-4627 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-14736 HIGH

OS Command Injection (CWE-78)

2026-03-24 VulDB

D-Link Command Injection

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Mar 24, 2026 - 04:30 euvd

EUVD-2026-14736

Analysis Generated

Mar 24, 2026 - 04:30 vuln.today

CVE Published

Mar 24, 2026 - 03:32 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_time of the file libdeuteron_modules.so of the component NTP Service. The manipulation results in os command injection. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1 respectively. The flaw resides in the handler_update_system_time function within the libdeuteron_modules.so library of the NTP Service component, allowing authenticated attackers with high privileges to execute arbitrary operating system commands remotely. These products are end-of-life and no longer supported by D-Link, meaning no patches will be released.

Technical ContextAI

The vulnerability is classified as CWE-78 (OS Command Injection) and affects the Network Time Protocol (NTP) service implementation in D-Link consumer routers. Specifically, the handler_update_system_time function in the libdeuteron_modules.so shared library fails to properly sanitize user input when processing NTP-related system time updates. The affected products are identified via CPE as cpe:2.3:a:d-link:dir-825:*:*:*:*:*:*:*:* and cpe:2.3:a:d-link:dir-825r:*:*:*:*:*:*:*:*. Command injection vulnerabilities occur when an application passes unsafe user-supplied data to a system shell, allowing attackers to append malicious commands that the system executes with the application's privileges.

RemediationAI

Replace affected D-Link DIR-825 and DIR-825R routers with currently supported models from D-Link or alternative vendors, as these products are end-of-life and will not receive security patches per the vendor's lifecycle policy (see https://www.dlink.com/). As an interim risk reduction measure until hardware replacement, disable remote administrative access to the router's web interface, change default administrator credentials to strong unique passwords, restrict administrative interface access to trusted internal IP addresses only via access control lists, disable the NTP service if external time synchronization is not required, and place the devices behind a firewall that blocks inbound management traffic. Organizations should prioritize immediate replacement over prolonged mitigation given the EOL status and command injection severity.