D-Link
Monthly
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the `peer_hostname` argument of `tunnel_set_params`. The flaw resides in the router's L2TP Control Message Parser (`progs.gpl/pppd.alpha/l2tp/tunnel.c`) and carries full C/I/A impact on the device. A public proof-of-concept writeup explicitly confirming out-of-bounds write primitives has been published, though exploitation complexity is rated high.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
OS command injection in D-Link DNS-320 ShareCenter firmware 2.06B01 allows a remote authenticated attacker to execute arbitrary operating system commands by supplying a crafted value for the fileurl parameter in the File Sharing CGI handler (/cgi/file_sharing.cgi). The vulnerability carries a CVSS 4.0 base score of 8.5 with high-privilege requirement but yields full system-level compromise on success, including subsequent-system impact. A public exploit has been disclosed, materially lowering the barrier to exploitation for any remaining deployments of this legacy NAS appliance.
OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the `callback_url` or `sync_interval` arguments passed to the `/cgi-bin/dropbox.cgi` CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. No patch has been identified at time of analysis, and the DNS-340L is likely an end-of-life product with no vendor remediation roadmap.
OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk.
OS command injection in D-Link DNS-327L and DNS-340L NAS devices (all firmware versions through 20260717) allows a remote authenticated attacker to execute arbitrary operating system commands by supplying crafted input to the f_dev parameter of the /cgi-bin/ve_mgr.cgi endpoint. A proof-of-concept exploit is publicly available, materially lowering the barrier for post-authentication abuse. Full OS-level compromise - including persistent backdoor installation and wholesale data exfiltration from attached storage - is achievable; this CVE is not currently listed in CISA KEV, so widespread active exploitation has not been confirmed.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched.
OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated.
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.
Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.
OS command injection in the D-Link DCS-935L Wi-Fi network camera (firmware 1.10.01) lets a remote attacker inject arbitrary operating-system commands through the UID POST parameter handled by the sub_400E40 function in setconf.cgi. The CVSS 4.0 vector requires low privileges (PR:L), so an attacker needs some level of authenticated/session access, after which they gain full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as actively exploited in the wild.
Format string vulnerability in the D-Link DCS-935L 1.10.01 IP camera allows authenticated remote attackers to corrupt memory and likely achieve information disclosure or code execution by manipulating the data argument passed to snprintf within the /web/cgi-bin/greece/rhea HTTP handler. Publicly available exploit code exists per VulDB submission, though this CVE is not on the CISA KEV list. The CVSS 4.0 score of 7.4 reflects high impact on confidentiality, integrity, and availability with low-privilege authentication required.
Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows authenticated remote attackers to corrupt memory via the Time parameter passed to the sprintf function in /httpd_debug.asp. Publicly available exploit code exists on GitHub, and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privilege requirement and no user interaction. The vulnerability targets an embedded networking appliance commonly deployed at SMB and branch-office perimeters, increasing exposure risk where the management interface is reachable.
Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by manipulating the 'str' parameter in /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges per the CVSS 4.0 vector. The original researcher advisory notes contradictory parameter names, introducing some uncertainty about the exact trigger field.
Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achieve complete system compromise via crafted AdminPassword parameter to the HNAP service. Public exploit code exists on GitHub (0xcc12138/DCS-935L-HNAP-Service-CVE), demonstrating weaponization of this vulnerability. CVSS 4.0 score of 7.4 with CVSS:4.0/E:P confirms proof-of-concept exploitation. While authentication is required (PR:L), the low attack complexity (AC:L) and network attack vector (AV:N) combined with publicly available exploit code make this a practical remote exploitation risk for devices exposed to untrusted networks or compromised accounts.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 enables authenticated remote code execution via crafted input to the /user_group.asp CGI handler. Attackers with high-privilege (administrator) credentials can exploit the unsafe sprintf function to achieve arbitrary code execution with complete system compromise. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation despite the high-privilege requirement.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code via crafted 'Name' parameter to /url_member.asp in the web management interface. Public exploit code exists on GitHub, demonstrating active proof-of-concept availability. EPSS data unavailable; CVSS 7.2 reflects high impact but limited by requirement for high-privilege (admin) authentication, reducing real-world urgency for most organizations unless admin credentials are compromised or insider threat exists.
Buffer overflow in D-Link DI-8100 router (firmware 16.07.26A1) allows authenticated remote attackers to execute arbitrary code or crash the device via crafted HTTP requests to the /tggl.asp endpoint. The vulnerability affects the tggl_asp function's Name parameter handling. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation for attackers with valid router credentials.
Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version.
Stack-based buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated remote attackers with high privileges to execute arbitrary code via malformed ID parameter to yyxz.asp administrative interface. Public exploit code exists on GitHub, demonstrating reliable exploitation. CVSS 7.3 (High) reflects network attack vector but requires admin-level authentication, limiting real-world exposure to compromised credentials or insider scenarios.
Hardcoded telnet backdoor in D-Link DIR-456U Hardware Revision A1 firmware grants remote unauthenticated attackers root shell access using static credentials ('Alphanetworks' / 'whdrv01_dlob_dir456U'). The telnet daemon launches automatically at boot via /etc/init0.d/S80telnetd.sh and validates credentials through strcmp() comparison against hardcoded values in /etc/config/image_sign. Device is End-of-Life with no patches forthcoming. CVSS 9.8 reflects network-accessible unauthenticated remote code execution, though exploitation requires local network access to telnet service.
Remote root shell access via hardcoded telnet backdoor in D-Link DIR-600L Hardware Revision A1 allows network-adjacent attackers to authenticate with publicly known credentials ('Alphanetworks' / 'wrgn35_dlwbr_dir600l') and obtain full administrative control. The backdoor telnet daemon launches automatically at boot with static credentials stored in /etc/alpha_config/image_sign. The device is End-of-Life with no patches forthcoming, creating permanent exposure for deployed units. EPSS data not available; no CISA KEV listing identified, though the trivial exploitation complexity (CVSS AC:L, PR:N) and public disclosure make exploitation highly likely once details are disseminated.
D-Link DIR-600L Hardware Revision B1 routers expose a hardcoded telnet backdoor granting unauthenticated remote attackers root shell access via static credentials ('Alphanetworks' / 'wrgn61_dlwbr_dir600L'). The vulnerability affects End-of-Life devices that will never receive patches, making permanent network isolation or replacement the only remediation options. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly documented credentials, this represents critical risk for any exposed device, though exploitation requires local network access despite the 'Network' attack vector classification.
Hardcoded telnet backdoor in D-Link DIR-605L Hardware Revision B2 firmware enables unauthenticated root access for remote attackers on the local network using static credentials 'Alphanetworks:wrgn76_dlwbr_dir605L'. The telnet daemon starts automatically at boot, validating credentials via strcmp() against hardcoded values in /etc/alpha_config/image_sign, granting complete administrative control to anyone who knows the password. This End-of-Life device will receive no security patches. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted disclosure rather than widespread exploitation campaigns.
Hardcoded credentials in D-Link DIR-605L Hardware Revision A1 firmware grant root-level telnet access to unauthenticated attackers on adjacent networks. The telnet daemon automatically starts at boot with username 'Alphanetworks' and static password 'wrgn35_dlwbr_dir605l', enabling complete device takeover including network traffic interception, configuration modification, and pivot attacks against internal networks. This End-of-Life product will receive no vendor patch, requiring immediate device replacement. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, with adjacent network attack vector reducing but not eliminating risk for home and small office deployments.
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
Brute-force protection bypass in D-Link DWM-222W USB Wi-Fi Adapter allows remote unauthenticated attackers to perform unlimited authentication attempts against the device's login interface. The vulnerability eliminates rate limiting controls, enabling adversaries to systematically guess credentials until device takeover is achieved. CVSS 8.7 reflects the high integrity impact (VI:H) from potential device compromise, though no public exploit code has been identified and CISA has not flagged active exploitation.
Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in POST request handling at /goform/formAdvanceSetup endpoint, where insufficient input validation of the 'webpage' parameter triggers memory corruption. Publicly available exploit code exists. This router model is end-of-life with no vendor support.
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The formSetRoute function improperly validates the curTime parameter, enabling memory corruption attacks. Publicly available exploit code exists. This vulnerability affects end-of-life hardware no longer supported by D-Link, leaving no vendor remediation pathway.
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. Exploitation occurs through POST request manipulation of the curTime parameter in /goform/formSetPassword endpoint. This end-of-life product receives no vendor support, and publicly available exploit code exists. Attack requires low-privilege authentication (CVSS PR:L) but no user interaction, enabling straightforward remote exploitation once credentials are obtained.
Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to achieve arbitrary code execution via crafted POST requests to /goform/formAdvNetwork endpoint. Exploitation manipulates the curTime parameter in the formAdvNetwork function, triggering memory corruption. This end-of-life device receives no vendor support; publicly available exploit code exists. Affected hardware presents elevated risk in legacy network environments where administrative credentials may be compromised.
Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to execute arbitrary code via the formAdvFirewall function in POST request handler. Exploitation occurs through manipulation of the curTime parameter in /goform/formAdvFirewall endpoint. Publicly available exploit code exists. This end-of-life product receives no vendor security support, requiring immediate device replacement for affected deployments.
Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution through malicious curTime parameter in formVirtualServ function via POST request to /goform/formVirtualServ endpoint. Affects end-of-life product with no vendor support. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling remote compromise of device confidentiality and integrity.
OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.
Stack-based buffer overflow in D-Link DIR-645 router (versions 1.01, 1.02, 1.03) via hedwigcgi_main function in /cgi-bin/hedwig.cgi allows authenticated remote attackers to achieve complete system compromise. Exploitation requires low-privilege credentials but no user interaction. Publicly available exploit code exists. Product is end-of-life with no vendor support, making remediation limited to device replacement or network isolation.
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute arbitrary code with high impact across 21 product models. The vulnerability resides in the cgi_addgroup_get_group_quota_minsize function within /cgi-bin/account_mgr.cgi, exploitable via malicious Name parameter input. Public exploit code exists on GitHub, significantly lowering the technical barrier for attacks. Authentication is required (PR:L), but once authenticated, attackers achieve full confidentiality, integrity, and availability compromise. EPSS and KEV status not provided, but the combination of public POC, network accessibility (AV:N), low complexity (AC:L), and widespread device deployment represents material risk to organizations using affected D-Link NAS products.
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compromise with high-confidence exploitation. Affects 20+ D-Link DNS and DNR series network storage products through firmware versions released until February 5, 2026. Publicly available exploit code exists targeting the account_mgr.cgi component, enabling remote code execution with low attack complexity once authenticated. CVSS 8.8 (High) with confirmed proof-of-concept demonstrates practical exploitability despite requiring low-privilege authentication.
Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with full system privileges. Affecting 20+ end-of-life D-Link DNS and DNR network storage models through firmware version 20260205, the flaw resides in the Webdav_Upload_File function within /cgi-bin/webdav_mgr.cgi. Publicly available exploit code exists, significantly lowering the barrier to exploitation. CVSS 8.8 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. Organizations using these legacy devices face immediate risk of complete confidentiality, integrity, and availability compromise.
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authenticated users. The vulnerability resides in the UPnP_AV_Server_Path_Del function within /cgi-bin/app_mgr.cgi, exploitable via manipulation of the f_dir parameter. With CVSS 8.8 (High), low attack complexity (AC:L), network accessibility (AV:N), and publicly available exploit code, this represents an elevated threat to approximately 20 legacy D-Link NAS models through firmware versions up to 20260205. No vendor-released patch identified at time of analysis, and many affected models appear to be end-of-life products.
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability affects the formSetEmail function via manipulation of the curTime parameter. Publicly available exploit code exists on GitHub, significantly lowering the exploitation barrier. CRITICAL LIMITATION: This product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices. CVSS 8.8 with low attack complexity and CVSS:3.1 Exploit Maturity 'Proof-of-Concept' confirms immediate exploitability.
An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1 respectively. The flaw resides in the handler_update_system_time function within the libdeuteron_modules.so library of the NTP Service component, allowing authenticated attackers with high privileges to execute arbitrary operating system commands remotely. These products are end-of-life and no longer supported by D-Link, meaning no patches will be released.
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endpoint allows authenticated attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with valid credentials can exploit this remotely without user interaction to execute arbitrary commands with system privileges.
Stack-based buffer overflow in D-Link DHP-1320 PowerLine AV adapter (firmware 1.00WWB04) allows remote authenticated attackers to execute arbitrary code with full device control via malformed SOAP requests to the redirect_count_down_page function. Publicly available exploit code exists on GitHub (confirmed by VulDB). EPSS score of 0.04% (14th percentile) indicates low observed exploitation in the wild despite POC availability. Product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices.
Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint allows unauthenticated attackers to achieve full system compromise through a malicious curTime parameter. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with network access can execute arbitrary code with high privileges without user interaction.
Stack-based buffer overflow in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-326, DNS-1100-4, and others) through the UPnP_AV_Server_Path_Setting function in /cgi-bin/app_mgr.cgi allows authenticated remote attackers to achieve complete system compromise with high integrity, confidentiality, and availability impact. Public exploit code exists for this vulnerability, and no patch is currently available.
Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cgi-bin/gui_mgr.cgi endpoint allows remote authenticated attackers to achieve code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected firmware versions are dated up to February 5, 2026.
Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to achieve remote code execution via the Downloads_Schedule_Info function in /cgi-bin/download_mgr.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed over the network with high impact on confidentiality, integrity, and availability.
Stack-based buffer overflow in D-Link DNS and DNR network storage devices allows authenticated remote attackers to execute arbitrary code by manipulating the f_idx parameter in the local_backup_mgr.cgi endpoint. Public exploit code exists for this vulnerability, which affects multiple device models up to firmware version 20260205 with no patch currently available. An attacker with valid credentials can trigger memory corruption to achieve complete system compromise including code execution, data theft, and service disruption.
Remote code execution in D-Link DIR-619L 2.06B01 results from a stack-based buffer overflow in the formSchedule function when the curTime parameter is manipulated via the /goform/formSchedule endpoint. An authenticated remote attacker can exploit this vulnerability to achieve full system compromise, and public exploit code is currently available. This vulnerability affects only end-of-life devices that no longer receive security updates.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available on GitHub, making this vulnerability actively exploitable. However, D-Link no longer supports this product, meaning no patch will be released.
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wireless configuration interface (/goform/form2WlanBasicSetup.cgi). A publicly available proof-of-concept exploit exists, allowing remote attackers without authentication to achieve complete system compromise. The vulnerability affects end-of-life products no longer supported by D-Link, making patches unlikely.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to achieve full system compromise without authentication. A public proof-of-concept exploit is available on GitHub, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (firmware version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbitrary OS commands by crafting a malicious Hostname option in a DHCP request. The vulnerable code path is in the `sendACK` function of `udhcpcd/serverpacket.c`, where the client-supplied Hostname field is processed without sanitization, leading to shell injection. A public proof-of-concept exploit exists targeting firmware version A1_102b07, and no vendor patch has been identified at time of analysis.
Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). No public exploit identified at time of analysis as confirmed CISA KEV listing, but a proof-of-concept has been made public, and most affected devices are likely end-of-life with no patch forthcoming.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the `/web/web_file/upload.php` endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.
Least-privilege violation in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) stems from insecure configuration of the Boa web server via /etc/boa/boa.conf, allowing an authenticated remote attacker to abuse over-broad privileges to compromise confidentiality, integrity, and availability. Publicly available exploit code exists, but the CVSS 4.0 vector rates attack complexity high (AC:H) and vendor guidance notes exploitation is difficult; there is no public exploit identified as actively exploited (not in CISA KEV). EPSS data was not supplied, but the low-privilege network vector combined with full CIA impact makes this a meaningful risk on exposed devices.
Least privilege violation in the D-Link DGS-1100-08PD managed switch firmware version 1.00.006 allows remote unauthenticated attackers to achieve low-integrity impact through improper processing of the Boa web server configuration file /etc/boa.conf via the device's web interface. The CVSS 4.0 score is 2.9 (Low), reflecting high attack complexity (AC:H) and constrained impact (VI:L only), though a publicly available proof-of-concept lowers the barrier for skilled attackers. No active exploitation has been confirmed in CISA KEV, making this a low-priority but trackable risk for network operators deploying this switch model.
Unauthenticated remote exploitation of the Boa embedded web server on the D-Link DCS-5615 IP camera (firmware 1.01.00) allows attackers to violate the principle of least privilege via manipulation of the `/etc/conf.d/boa/boa.conf` configuration component. The CVSS 4.0 vector confirms network-reachable, zero-complexity, no-authentication access with an active proof-of-concept exploit publicly available. No public KEV listing is present, but the PoC status elevates real-world risk for this class of always-on, internet-facing IoT device.
Least privilege violation in D-Link DIR-823G firmware version 1.0.2B05 exposes the vsftpd FTP daemon configuration file (/etc/vsftpd.conf) to manipulation by network-accessible, low-privileged authenticated users, enabling unauthorized modification of FTP service behavior. The CVSS vector (AV:N/AC:L/PR:L/UI:N/I:L) confirms this is remotely exploitable with low complexity by any authenticated user, resulting in limited integrity impact. A publicly available proof-of-concept exploit has been released per VulDB reporting (E:P), though no active exploitation has been confirmed in CISA KEV at this time.
OS command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary shell commands on the device via the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The vulnerable function sub_412DA0 fails to sanitize attacker-controlled input before passing it to an OS-level command, granting low-privilege network access sufficient to achieve code execution with the confidence of a partial proof-of-concept. A publicly available exploit has been disclosed on GitHub, elevating practical risk beyond the CVSS 6.3 score alone.
Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows remote authenticated attackers to execute arbitrary OS commands via the `ussdValue` parameter of the `/boafrm/formUSSDSetup` endpoint, processed by the vulnerable `sub_41CF20` function without input sanitization. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity exploitation requiring only low-privilege credentials - a realistic threshold on consumer routers commonly deployed with default or weak passwords. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk above what the moderate CVSS score of 6.3 suggests; no public exploit identified at time of analysis maps to confirmed active exploitation (not in CISA KEV).
Command injection in D-Link DWR-M920 router firmware versions 1.1.50 and 1.1.70 allows a low-privileged, remote-authenticated attacker to inject OS commands via the action_value parameter in the SMS management endpoint /boafrm/formSmsManage. The vulnerability resides in the C function sub_41C8E8 and stems from unsanitized user input being passed directly to a command interpreter (CWE-77). A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the absence of CISA KEV listing.
D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ip_address argument passed to the portForward function without sanitization. A public proof-of-concept is available on GitHub, lowering the skill bar for exploitation. No CISA KEV listing exists, but EPSS places this at the 66th percentile, indicating greater exploitation likelihood than two-thirds of all tracked CVEs.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the ip_address parameter in the /goform/singlePortForward endpoint. The root cause is the sub_445E7C function passing unsanitized user input directly to a system command (CWE-77), and a proof-of-concept exploit has been publicly disclosed on GitHub. No active exploitation has been confirmed by CISA KEV at time of analysis, though the EPSS score places this CVE at the 66th percentile for exploitation likelihood.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to execute arbitrary OS commands by manipulating input passed to the sub_445E7C function via the /goform/formDMZ.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, confirmed by VulDB and referenced in EUVD-2026-29345. No vendor patch has been identified at time of analysis, and the device's age and regional positioning suggest it may be unsupported, leaving affected deployments permanently exposed absent compensating controls.
OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated administrators to execute arbitrary system commands via unsanitized input to multiple CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) in /cgi-bin/system_mgr.cgi. CVSS 5.1 reflects high-privileged access requirement (PR:H) mitigating network-accessible attack vector; however, the ability to inject OS commands via CGI endpoints creates significant risk in multi-user or compromised-admin scenarios. No public exploit code or active exploitation confirmed at time of analysis.
OS command injection in D-Link DNS-320 2.06B01 webfile_mgr.cgi allows remote authenticated attackers with high privileges to execute arbitrary commands through manipulated file operation parameters (delete, rename, copy, move, chmod, chown). Publicly available exploit code exists; CVSS 2.0 reflects high privilege requirement and limited confidentiality/integrity impact on the vulnerable system only.
OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated attackers with high privileges to execute arbitrary system commands via multiple CGI parameters in /cgi-bin/network_mgr.cgi (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit). Publicly available exploit code exists and the vulnerability has been documented with proof-of-concept on GitHub.
Weak password recovery in D-Link M60 up to version 1.20B02 allows remote attackers to compromise device authentication through manipulation of the /usr/bin/httpd binary, requiring high attack complexity but with publicly disclosed exploit code available. The vulnerability enables information disclosure and potential unauthorized access to device management functions despite the low CVSS score of 2.9 reflecting limited confidentiality impact.
Cross-site scripting (XSS) in D-Link DSL-2740R EU_01.15 allows authenticated remote attackers with high privileges to inject malicious scripts via the Wireless Network Name parameter in the Wireless Setup Section, affecting data integrity when a user views the compromised configuration. The vulnerability requires user interaction and administrative credentials, limiting its real-world exploitation scope despite publicly available exploit code.
Stored or reflected cross-site scripting (XSS) in D-Link DGS-3420 firmware 1.50.018 allows authenticated remote attackers to inject malicious scripts via the System Name parameter on the System Information Settings Page. The vulnerability requires high-level administrative privileges and user interaction (UI:R), limiting exploitation to scenarios where an authenticated admin visits a malicious page or clicks a crafted link. Publicly available exploit code exists; CVSS 4.5 reflects the requirement for admin access and user interaction, though the impact is information disclosure or session hijacking potential through XSS.
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up to 20260205) allow remote unauthenticated attackers to manipulate disk management functions via the /cgi-bin/dsk_mgr.cgi endpoint, resulting in availability impact. Publicly available exploit code exists and the vulnerability has moderate real-world exploitability (CVSS 5.5, EPSS probability indicated by E:P vector), requiring no authentication or user interaction for remote attack.
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the `peer_hostname` argument of `tunnel_set_params`. The flaw resides in the router's L2TP Control Message Parser (`progs.gpl/pppd.alpha/l2tp/tunnel.c`) and carries full C/I/A impact on the device. A public proof-of-concept writeup explicitly confirming out-of-bounds write primitives has been published, though exploitation complexity is rated high.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
OS command injection in D-Link DNS-320 ShareCenter firmware 2.06B01 allows a remote authenticated attacker to execute arbitrary operating system commands by supplying a crafted value for the fileurl parameter in the File Sharing CGI handler (/cgi/file_sharing.cgi). The vulnerability carries a CVSS 4.0 base score of 8.5 with high-privilege requirement but yields full system-level compromise on success, including subsequent-system impact. A public exploit has been disclosed, materially lowering the barrier to exploitation for any remaining deployments of this legacy NAS appliance.
OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the `callback_url` or `sync_interval` arguments passed to the `/cgi-bin/dropbox.cgi` CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. No patch has been identified at time of analysis, and the DNS-340L is likely an end-of-life product with no vendor remediation roadmap.
OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk.
OS command injection in D-Link DNS-327L and DNS-340L NAS devices (all firmware versions through 20260717) allows a remote authenticated attacker to execute arbitrary operating system commands by supplying crafted input to the f_dev parameter of the /cgi-bin/ve_mgr.cgi endpoint. A proof-of-concept exploit is publicly available, materially lowering the barrier for post-authentication abuse. Full OS-level compromise - including persistent backdoor installation and wholesale data exfiltration from attached storage - is achievable; this CVE is not currently listed in CISA KEV, so widespread active exploitation has not been confirmed.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched.
OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated.
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.
Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.
OS command injection in the D-Link DCS-935L Wi-Fi network camera (firmware 1.10.01) lets a remote attacker inject arbitrary operating-system commands through the UID POST parameter handled by the sub_400E40 function in setconf.cgi. The CVSS 4.0 vector requires low privileges (PR:L), so an attacker needs some level of authenticated/session access, after which they gain full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as actively exploited in the wild.
Format string vulnerability in the D-Link DCS-935L 1.10.01 IP camera allows authenticated remote attackers to corrupt memory and likely achieve information disclosure or code execution by manipulating the data argument passed to snprintf within the /web/cgi-bin/greece/rhea HTTP handler. Publicly available exploit code exists per VulDB submission, though this CVE is not on the CISA KEV list. The CVSS 4.0 score of 7.4 reflects high impact on confidentiality, integrity, and availability with low-privilege authentication required.
Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows authenticated remote attackers to corrupt memory via the Time parameter passed to the sprintf function in /httpd_debug.asp. Publicly available exploit code exists on GitHub, and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privilege requirement and no user interaction. The vulnerability targets an embedded networking appliance commonly deployed at SMB and branch-office perimeters, increasing exposure risk where the management interface is reachable.
Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by manipulating the 'str' parameter in /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges per the CVSS 4.0 vector. The original researcher advisory notes contradictory parameter names, introducing some uncertainty about the exact trigger field.
Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achieve complete system compromise via crafted AdminPassword parameter to the HNAP service. Public exploit code exists on GitHub (0xcc12138/DCS-935L-HNAP-Service-CVE), demonstrating weaponization of this vulnerability. CVSS 4.0 score of 7.4 with CVSS:4.0/E:P confirms proof-of-concept exploitation. While authentication is required (PR:L), the low attack complexity (AC:L) and network attack vector (AV:N) combined with publicly available exploit code make this a practical remote exploitation risk for devices exposed to untrusted networks or compromised accounts.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 enables authenticated remote code execution via crafted input to the /user_group.asp CGI handler. Attackers with high-privilege (administrator) credentials can exploit the unsafe sprintf function to achieve arbitrary code execution with complete system compromise. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation despite the high-privilege requirement.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code via crafted 'Name' parameter to /url_member.asp in the web management interface. Public exploit code exists on GitHub, demonstrating active proof-of-concept availability. EPSS data unavailable; CVSS 7.2 reflects high impact but limited by requirement for high-privilege (admin) authentication, reducing real-world urgency for most organizations unless admin credentials are compromised or insider threat exists.
Buffer overflow in D-Link DI-8100 router (firmware 16.07.26A1) allows authenticated remote attackers to execute arbitrary code or crash the device via crafted HTTP requests to the /tggl.asp endpoint. The vulnerability affects the tggl_asp function's Name parameter handling. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation for attackers with valid router credentials.
Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis.
Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version.
Stack-based buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated remote attackers with high privileges to execute arbitrary code via malformed ID parameter to yyxz.asp administrative interface. Public exploit code exists on GitHub, demonstrating reliable exploitation. CVSS 7.3 (High) reflects network attack vector but requires admin-level authentication, limiting real-world exposure to compromised credentials or insider scenarios.
Hardcoded telnet backdoor in D-Link DIR-456U Hardware Revision A1 firmware grants remote unauthenticated attackers root shell access using static credentials ('Alphanetworks' / 'whdrv01_dlob_dir456U'). The telnet daemon launches automatically at boot via /etc/init0.d/S80telnetd.sh and validates credentials through strcmp() comparison against hardcoded values in /etc/config/image_sign. Device is End-of-Life with no patches forthcoming. CVSS 9.8 reflects network-accessible unauthenticated remote code execution, though exploitation requires local network access to telnet service.
Remote root shell access via hardcoded telnet backdoor in D-Link DIR-600L Hardware Revision A1 allows network-adjacent attackers to authenticate with publicly known credentials ('Alphanetworks' / 'wrgn35_dlwbr_dir600l') and obtain full administrative control. The backdoor telnet daemon launches automatically at boot with static credentials stored in /etc/alpha_config/image_sign. The device is End-of-Life with no patches forthcoming, creating permanent exposure for deployed units. EPSS data not available; no CISA KEV listing identified, though the trivial exploitation complexity (CVSS AC:L, PR:N) and public disclosure make exploitation highly likely once details are disseminated.
D-Link DIR-600L Hardware Revision B1 routers expose a hardcoded telnet backdoor granting unauthenticated remote attackers root shell access via static credentials ('Alphanetworks' / 'wrgn61_dlwbr_dir600L'). The vulnerability affects End-of-Life devices that will never receive patches, making permanent network isolation or replacement the only remediation options. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly documented credentials, this represents critical risk for any exposed device, though exploitation requires local network access despite the 'Network' attack vector classification.
Hardcoded telnet backdoor in D-Link DIR-605L Hardware Revision B2 firmware enables unauthenticated root access for remote attackers on the local network using static credentials 'Alphanetworks:wrgn76_dlwbr_dir605L'. The telnet daemon starts automatically at boot, validating credentials via strcmp() against hardcoded values in /etc/alpha_config/image_sign, granting complete administrative control to anyone who knows the password. This End-of-Life device will receive no security patches. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted disclosure rather than widespread exploitation campaigns.
Hardcoded credentials in D-Link DIR-605L Hardware Revision A1 firmware grant root-level telnet access to unauthenticated attackers on adjacent networks. The telnet daemon automatically starts at boot with username 'Alphanetworks' and static password 'wrgn35_dlwbr_dir605l', enabling complete device takeover including network traffic interception, configuration modification, and pivot attacks against internal networks. This End-of-Life product will receive no vendor patch, requiring immediate device replacement. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, with adjacent network attack vector reducing but not eliminating risk for home and small office deployments.
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
Brute-force protection bypass in D-Link DWM-222W USB Wi-Fi Adapter allows remote unauthenticated attackers to perform unlimited authentication attempts against the device's login interface. The vulnerability eliminates rate limiting controls, enabling adversaries to systematically guess credentials until device takeover is achieved. CVSS 8.7 reflects the high integrity impact (VI:H) from potential device compromise, though no public exploit code has been identified and CISA has not flagged active exploitation.
Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in POST request handling at /goform/formAdvanceSetup endpoint, where insufficient input validation of the 'webpage' parameter triggers memory corruption. Publicly available exploit code exists. This router model is end-of-life with no vendor support.
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The formSetRoute function improperly validates the curTime parameter, enabling memory corruption attacks. Publicly available exploit code exists. This vulnerability affects end-of-life hardware no longer supported by D-Link, leaving no vendor remediation pathway.
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. Exploitation occurs through POST request manipulation of the curTime parameter in /goform/formSetPassword endpoint. This end-of-life product receives no vendor support, and publicly available exploit code exists. Attack requires low-privilege authentication (CVSS PR:L) but no user interaction, enabling straightforward remote exploitation once credentials are obtained.
Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to achieve arbitrary code execution via crafted POST requests to /goform/formAdvNetwork endpoint. Exploitation manipulates the curTime parameter in the formAdvNetwork function, triggering memory corruption. This end-of-life device receives no vendor support; publicly available exploit code exists. Affected hardware presents elevated risk in legacy network environments where administrative credentials may be compromised.
Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to execute arbitrary code via the formAdvFirewall function in POST request handler. Exploitation occurs through manipulation of the curTime parameter in /goform/formAdvFirewall endpoint. Publicly available exploit code exists. This end-of-life product receives no vendor security support, requiring immediate device replacement for affected deployments.
Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution through malicious curTime parameter in formVirtualServ function via POST request to /goform/formVirtualServ endpoint. Affects end-of-life product with no vendor support. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling remote compromise of device confidentiality and integrity.
OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.
Stack-based buffer overflow in D-Link DIR-645 router (versions 1.01, 1.02, 1.03) via hedwigcgi_main function in /cgi-bin/hedwig.cgi allows authenticated remote attackers to achieve complete system compromise. Exploitation requires low-privilege credentials but no user interaction. Publicly available exploit code exists. Product is end-of-life with no vendor support, making remediation limited to device replacement or network isolation.
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute arbitrary code with high impact across 21 product models. The vulnerability resides in the cgi_addgroup_get_group_quota_minsize function within /cgi-bin/account_mgr.cgi, exploitable via malicious Name parameter input. Public exploit code exists on GitHub, significantly lowering the technical barrier for attacks. Authentication is required (PR:L), but once authenticated, attackers achieve full confidentiality, integrity, and availability compromise. EPSS and KEV status not provided, but the combination of public POC, network accessibility (AV:N), low complexity (AC:L), and widespread device deployment represents material risk to organizations using affected D-Link NAS products.
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compromise with high-confidence exploitation. Affects 20+ D-Link DNS and DNR series network storage products through firmware versions released until February 5, 2026. Publicly available exploit code exists targeting the account_mgr.cgi component, enabling remote code execution with low attack complexity once authenticated. CVSS 8.8 (High) with confirmed proof-of-concept demonstrates practical exploitability despite requiring low-privilege authentication.
Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with full system privileges. Affecting 20+ end-of-life D-Link DNS and DNR network storage models through firmware version 20260205, the flaw resides in the Webdav_Upload_File function within /cgi-bin/webdav_mgr.cgi. Publicly available exploit code exists, significantly lowering the barrier to exploitation. CVSS 8.8 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. Organizations using these legacy devices face immediate risk of complete confidentiality, integrity, and availability compromise.
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authenticated users. The vulnerability resides in the UPnP_AV_Server_Path_Del function within /cgi-bin/app_mgr.cgi, exploitable via manipulation of the f_dir parameter. With CVSS 8.8 (High), low attack complexity (AC:L), network accessibility (AV:N), and publicly available exploit code, this represents an elevated threat to approximately 20 legacy D-Link NAS models through firmware versions up to 20260205. No vendor-released patch identified at time of analysis, and many affected models appear to be end-of-life products.
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability affects the formSetEmail function via manipulation of the curTime parameter. Publicly available exploit code exists on GitHub, significantly lowering the exploitation barrier. CRITICAL LIMITATION: This product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices. CVSS 8.8 with low attack complexity and CVSS:3.1 Exploit Maturity 'Proof-of-Concept' confirms immediate exploitability.
An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1 respectively. The flaw resides in the handler_update_system_time function within the libdeuteron_modules.so library of the NTP Service component, allowing authenticated attackers with high privileges to execute arbitrary operating system commands remotely. These products are end-of-life and no longer supported by D-Link, meaning no patches will be released.
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endpoint allows authenticated attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with valid credentials can exploit this remotely without user interaction to execute arbitrary commands with system privileges.
Stack-based buffer overflow in D-Link DHP-1320 PowerLine AV adapter (firmware 1.00WWB04) allows remote authenticated attackers to execute arbitrary code with full device control via malformed SOAP requests to the redirect_count_down_page function. Publicly available exploit code exists on GitHub (confirmed by VulDB). EPSS score of 0.04% (14th percentile) indicates low observed exploitation in the wild despite POC availability. Product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices.
Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint allows unauthenticated attackers to achieve full system compromise through a malicious curTime parameter. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with network access can execute arbitrary code with high privileges without user interaction.
Stack-based buffer overflow in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-326, DNS-1100-4, and others) through the UPnP_AV_Server_Path_Setting function in /cgi-bin/app_mgr.cgi allows authenticated remote attackers to achieve complete system compromise with high integrity, confidentiality, and availability impact. Public exploit code exists for this vulnerability, and no patch is currently available.
Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cgi-bin/gui_mgr.cgi endpoint allows remote authenticated attackers to achieve code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected firmware versions are dated up to February 5, 2026.
Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to achieve remote code execution via the Downloads_Schedule_Info function in /cgi-bin/download_mgr.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed over the network with high impact on confidentiality, integrity, and availability.
Stack-based buffer overflow in D-Link DNS and DNR network storage devices allows authenticated remote attackers to execute arbitrary code by manipulating the f_idx parameter in the local_backup_mgr.cgi endpoint. Public exploit code exists for this vulnerability, which affects multiple device models up to firmware version 20260205 with no patch currently available. An attacker with valid credentials can trigger memory corruption to achieve complete system compromise including code execution, data theft, and service disruption.
Remote code execution in D-Link DIR-619L 2.06B01 results from a stack-based buffer overflow in the formSchedule function when the curTime parameter is manipulated via the /goform/formSchedule endpoint. An authenticated remote attacker can exploit this vulnerability to achieve full system compromise, and public exploit code is currently available. This vulnerability affects only end-of-life devices that no longer receive security updates.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available on GitHub, making this vulnerability actively exploitable. However, D-Link no longer supports this product, meaning no patch will be released.
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wireless configuration interface (/goform/form2WlanBasicSetup.cgi). A publicly available proof-of-concept exploit exists, allowing remote attackers without authentication to achieve complete system compromise. The vulnerability affects end-of-life products no longer supported by D-Link, making patches unlikely.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to achieve full system compromise without authentication. A public proof-of-concept exploit is available on GitHub, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (firmware version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbitrary OS commands by crafting a malicious Hostname option in a DHCP request. The vulnerable code path is in the `sendACK` function of `udhcpcd/serverpacket.c`, where the client-supplied Hostname field is processed without sanitization, leading to shell injection. A public proof-of-concept exploit exists targeting firmware version A1_102b07, and no vendor patch has been identified at time of analysis.
Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). No public exploit identified at time of analysis as confirmed CISA KEV listing, but a proof-of-concept has been made public, and most affected devices are likely end-of-life with no patch forthcoming.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the `/web/web_file/upload.php` endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.
Least-privilege violation in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) stems from insecure configuration of the Boa web server via /etc/boa/boa.conf, allowing an authenticated remote attacker to abuse over-broad privileges to compromise confidentiality, integrity, and availability. Publicly available exploit code exists, but the CVSS 4.0 vector rates attack complexity high (AC:H) and vendor guidance notes exploitation is difficult; there is no public exploit identified as actively exploited (not in CISA KEV). EPSS data was not supplied, but the low-privilege network vector combined with full CIA impact makes this a meaningful risk on exposed devices.
Least privilege violation in the D-Link DGS-1100-08PD managed switch firmware version 1.00.006 allows remote unauthenticated attackers to achieve low-integrity impact through improper processing of the Boa web server configuration file /etc/boa.conf via the device's web interface. The CVSS 4.0 score is 2.9 (Low), reflecting high attack complexity (AC:H) and constrained impact (VI:L only), though a publicly available proof-of-concept lowers the barrier for skilled attackers. No active exploitation has been confirmed in CISA KEV, making this a low-priority but trackable risk for network operators deploying this switch model.
Unauthenticated remote exploitation of the Boa embedded web server on the D-Link DCS-5615 IP camera (firmware 1.01.00) allows attackers to violate the principle of least privilege via manipulation of the `/etc/conf.d/boa/boa.conf` configuration component. The CVSS 4.0 vector confirms network-reachable, zero-complexity, no-authentication access with an active proof-of-concept exploit publicly available. No public KEV listing is present, but the PoC status elevates real-world risk for this class of always-on, internet-facing IoT device.
Least privilege violation in D-Link DIR-823G firmware version 1.0.2B05 exposes the vsftpd FTP daemon configuration file (/etc/vsftpd.conf) to manipulation by network-accessible, low-privileged authenticated users, enabling unauthorized modification of FTP service behavior. The CVSS vector (AV:N/AC:L/PR:L/UI:N/I:L) confirms this is remotely exploitable with low complexity by any authenticated user, resulting in limited integrity impact. A publicly available proof-of-concept exploit has been released per VulDB reporting (E:P), though no active exploitation has been confirmed in CISA KEV at this time.
OS command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary shell commands on the device via the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The vulnerable function sub_412DA0 fails to sanitize attacker-controlled input before passing it to an OS-level command, granting low-privilege network access sufficient to achieve code execution with the confidence of a partial proof-of-concept. A publicly available exploit has been disclosed on GitHub, elevating practical risk beyond the CVSS 6.3 score alone.
Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows remote authenticated attackers to execute arbitrary OS commands via the `ussdValue` parameter of the `/boafrm/formUSSDSetup` endpoint, processed by the vulnerable `sub_41CF20` function without input sanitization. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity exploitation requiring only low-privilege credentials - a realistic threshold on consumer routers commonly deployed with default or weak passwords. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk above what the moderate CVSS score of 6.3 suggests; no public exploit identified at time of analysis maps to confirmed active exploitation (not in CISA KEV).
Command injection in D-Link DWR-M920 router firmware versions 1.1.50 and 1.1.70 allows a low-privileged, remote-authenticated attacker to inject OS commands via the action_value parameter in the SMS management endpoint /boafrm/formSmsManage. The vulnerability resides in the C function sub_41C8E8 and stems from unsanitized user input being passed directly to a command interpreter (CWE-77). A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the absence of CISA KEV listing.
D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ip_address argument passed to the portForward function without sanitization. A public proof-of-concept is available on GitHub, lowering the skill bar for exploitation. No CISA KEV listing exists, but EPSS places this at the 66th percentile, indicating greater exploitation likelihood than two-thirds of all tracked CVEs.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the ip_address parameter in the /goform/singlePortForward endpoint. The root cause is the sub_445E7C function passing unsanitized user input directly to a system command (CWE-77), and a proof-of-concept exploit has been publicly disclosed on GitHub. No active exploitation has been confirmed by CISA KEV at time of analysis, though the EPSS score places this CVE at the 66th percentile for exploitation likelihood.
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to execute arbitrary OS commands by manipulating input passed to the sub_445E7C function via the /goform/formDMZ.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, confirmed by VulDB and referenced in EUVD-2026-29345. No vendor patch has been identified at time of analysis, and the device's age and regional positioning suggest it may be unsupported, leaving affected deployments permanently exposed absent compensating controls.
OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated administrators to execute arbitrary system commands via unsanitized input to multiple CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) in /cgi-bin/system_mgr.cgi. CVSS 5.1 reflects high-privileged access requirement (PR:H) mitigating network-accessible attack vector; however, the ability to inject OS commands via CGI endpoints creates significant risk in multi-user or compromised-admin scenarios. No public exploit code or active exploitation confirmed at time of analysis.
OS command injection in D-Link DNS-320 2.06B01 webfile_mgr.cgi allows remote authenticated attackers with high privileges to execute arbitrary commands through manipulated file operation parameters (delete, rename, copy, move, chmod, chown). Publicly available exploit code exists; CVSS 2.0 reflects high privilege requirement and limited confidentiality/integrity impact on the vulnerable system only.
OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated attackers with high privileges to execute arbitrary system commands via multiple CGI parameters in /cgi-bin/network_mgr.cgi (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit). Publicly available exploit code exists and the vulnerability has been documented with proof-of-concept on GitHub.
Weak password recovery in D-Link M60 up to version 1.20B02 allows remote attackers to compromise device authentication through manipulation of the /usr/bin/httpd binary, requiring high attack complexity but with publicly disclosed exploit code available. The vulnerability enables information disclosure and potential unauthorized access to device management functions despite the low CVSS score of 2.9 reflecting limited confidentiality impact.
Cross-site scripting (XSS) in D-Link DSL-2740R EU_01.15 allows authenticated remote attackers with high privileges to inject malicious scripts via the Wireless Network Name parameter in the Wireless Setup Section, affecting data integrity when a user views the compromised configuration. The vulnerability requires user interaction and administrative credentials, limiting its real-world exploitation scope despite publicly available exploit code.
Stored or reflected cross-site scripting (XSS) in D-Link DGS-3420 firmware 1.50.018 allows authenticated remote attackers to inject malicious scripts via the System Name parameter on the System Information Settings Page. The vulnerability requires high-level administrative privileges and user interaction (UI:R), limiting exploitation to scenarios where an authenticated admin visits a malicious page or clicks a crafted link. Publicly available exploit code exists; CVSS 4.5 reflects the requirement for admin access and user interaction, though the impact is information disclosure or session hijacking potential through XSS.
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up to 20260205) allow remote unauthenticated attackers to manipulate disk management functions via the /cgi-bin/dsk_mgr.cgi endpoint, resulting in availability impact. Publicly available exploit code exists and the vulnerability has moderate real-world exploitability (CVSS 5.5, EPSS probability indicated by E:P vector), requiring no authentication or user interaction for remote attack.