D-Link

Command injection in the D-Link DI-7001 MINI_5G router (firmware 19.10.31A1) allows unauthenticated attackers on the adjacent network to execute arbitrary OS commands via the `flag` parameter of the `msp_info` endpoint. The vulnerability is rooted in CWE-77 (improper neutralization of command-special elements), and a public proof-of-concept writeup has been published on GitHub, lowering the exploitation bar. No active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.17% (6th percentile), indicating limited observed exploitation activity at time of analysis.

Remote code execution in D-Link DI-8100G firmware 17.12.20A1 is achievable by unauthenticated attackers positioned on the adjacent network via a crafted `flag` parameter in the `msp_info` CGI handler. The flaw (CWE-94, Code Injection) permits full compromise of device confidentiality and integrity with no privileges or user interaction required, yielding a CVSS 8.1 (High) rating. A researcher-published proof-of-concept exists on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% reflects low observed exploitation probability at the time of analysis.

Incorrect default permissions in the vsftpd FTP service on D-Link DIR-842 firmware 2.01.B04 allow a remotely authenticated low-privileged attacker to achieve limited integrity impact under high-complexity conditions via manipulation of /etc/vsftpd.conf. The vulnerability carries a CVSS 4.0 score of 2.3, placing it in the low-severity tier with no active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis. The discrepancy between the 'Information Disclosure' tag and the CVSS showing no confidentiality impact (VC:N) introduces some ambiguity about the full impact scope.

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware C1, firmware 1.1.2_C1_202602110044) lets a remote attacker inject arbitrary shell commands through the netDig.ping.dst parameter of the app.cgi diagnostic interface, yielding command execution as root. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; a vendor patch is available (SAP10512), and no public exploit has been identified at time of analysis.

OS command injection in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware before 1.1.5_C1_202607071108) lets a remote, unauthenticated attacker inject shell commands through the localPin parameter of the /boafrm/formWsc (WPS) endpoint, yielding command execution as root. The flaw carries a CVSS 4.0 score of 9.3 and was reported by VulnCheck; a vendor patch exists (SAP10512), but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary commands as root by injecting shell metacharacters into the tunnelid and sessionid parameters of the /boafrm/formL2tpv3ConfigSetup web interface. The flaw was reported by VulnCheck and a vendor patch is available (D-Link SAP10512); no public exploit identified at time of analysis. The CVSS 4.0 vector rates it 9.3 with full confidentiality, integrity, and availability impact on the router.

Remote OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets an attacker execute arbitrary commands as root by supplying shell metacharacters in the ntpServerIp1 parameter of the /boafrm/formNtp web interface. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication and no user interaction, yielding full compromise (VC:H/VI:H/VA:H). No public exploit was identified at time of analysis, and it is not listed in CISA KEV; a vendor firmware patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the oldPIn parameter of the /boafrm/formPinManageSetup web endpoint. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device takeover. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.

Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck.

Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. No public exploit identified at time of analysis, but a vendor patch is available.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets a remote attacker execute arbitrary commands as root through the /boafrm/formUSSDSetup web interface. Unsanitized input in the ussdValue and selectMenuValue parameters is passed to a shell, giving full device takeover with high confidentiality, integrity, and availability impact (CVSS 4.0 9.3). Reported by VulnCheck; no public exploit identified at time of analysis, and a vendor patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not currently listed in CISA KEV.

Remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware version C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to run arbitrary OS commands as root by injecting into the host and ipVer parameters of the /boafrm/formTracerouteDiagnosticRun web interface. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not in CISA KEV, but a vendor patch has been released and the finding was reported by VulnCheck.

Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the trivially exploitable vector and VulnCheck reporting make this a high-priority patch.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). Reported by VulnCheck with a vendor patch now available; no public exploit identified at time of analysis.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting shell metacharacters into the fota_url parameter of the /boafrm/formLtefotaUpgradeQuectel web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw yields full device takeover with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability makes it a strong candidate for weaponization.

Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). No public exploit identified at time of analysis as confirmed CISA KEV listing, but a proof-of-concept has been made public, and most affected devices are likely end-of-life with no patch forthcoming.

Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.

Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.

Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.

Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.

Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.

Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the `/web/web_file/upload.php` endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.

Privilege escalation in D-Link DIR-1253 firmware v1.0.1.250923.142435 stems from improper handling of the /etc/shadow file - the store of hashed local credentials - letting an attacker obtain or elevate to root-level access on the device. Publicly available exploit code exists (referenced via the zuh.re/codeberg advisory), but there is no public exploit identified as actively exploited and the CVE is not on the CISA KEV list. The published CVSS of 9.8 (AV:N) appears optimistic given that the core issue centers on a local system credential file, so the true remote-unauthenticated reach should be verified against the vendor advisory.

Least-privilege violation in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) stems from insecure configuration of the Boa web server via /etc/boa/boa.conf, allowing an authenticated remote attacker to abuse over-broad privileges to compromise confidentiality, integrity, and availability. Publicly available exploit code exists, but the CVSS 4.0 vector rates attack complexity high (AC:H) and vendor guidance notes exploitation is difficult; there is no public exploit identified as actively exploited (not in CISA KEV). EPSS data was not supplied, but the low-privilege network vector combined with full CIA impact makes this a meaningful risk on exposed devices.

OS command injection in the D-Link DCS-935L Wi-Fi network camera (firmware 1.10.01) lets a remote attacker inject arbitrary operating-system commands through the UID POST parameter handled by the sub_400E40 function in setconf.cgi. The CVSS 4.0 vector requires low privileges (PR:L), so an attacker needs some level of authenticated/session access, after which they gain full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as actively exploited in the wild.

Format string vulnerability in the D-Link DCS-935L 1.10.01 IP camera allows authenticated remote attackers to corrupt memory and likely achieve information disclosure or code execution by manipulating the data argument passed to snprintf within the /web/cgi-bin/greece/rhea HTTP handler. Publicly available exploit code exists per VulDB submission, though this CVE is not on the CISA KEV list. The CVSS 4.0 score of 7.4 reflects high impact on confidentiality, integrity, and availability with low-privilege authentication required.

Least privilege violation in the D-Link DGS-1100-08PD managed switch firmware version 1.00.006 allows remote unauthenticated attackers to achieve low-integrity impact through improper processing of the Boa web server configuration file /etc/boa.conf via the device's web interface. The CVSS 4.0 score is 2.9 (Low), reflecting high attack complexity (AC:H) and constrained impact (VI:L only), though a publicly available proof-of-concept lowers the barrier for skilled attackers. No active exploitation has been confirmed in CISA KEV, making this a low-priority but trackable risk for network operators deploying this switch model.

Unauthenticated remote exploitation of the Boa embedded web server on the D-Link DCS-5615 IP camera (firmware 1.01.00) allows attackers to violate the principle of least privilege via manipulation of the `/etc/conf.d/boa/boa.conf` configuration component. The CVSS 4.0 vector confirms network-reachable, zero-complexity, no-authentication access with an active proof-of-concept exploit publicly available. No public KEV listing is present, but the PoC status elevates real-world risk for this class of always-on, internet-facing IoT device.

Least privilege violation in D-Link DIR-823G firmware version 1.0.2B05 exposes the vsftpd FTP daemon configuration file (/etc/vsftpd.conf) to manipulation by network-accessible, low-privileged authenticated users, enabling unauthorized modification of FTP service behavior. The CVSS vector (AV:N/AC:L/PR:L/UI:N/I:L) confirms this is remotely exploitable with low complexity by any authenticated user, resulting in limited integrity impact. A publicly available proof-of-concept exploit has been released per VulDB reporting (E:P), though no active exploitation has been confirmed in CISA KEV at this time.

OS command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary shell commands on the device via the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The vulnerable function sub_412DA0 fails to sanitize attacker-controlled input before passing it to an OS-level command, granting low-privilege network access sufficient to achieve code execution with the confidence of a partial proof-of-concept. A publicly available exploit has been disclosed on GitHub, elevating practical risk beyond the CVSS 6.3 score alone.

Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows remote authenticated attackers to execute arbitrary OS commands via the `ussdValue` parameter of the `/boafrm/formUSSDSetup` endpoint, processed by the vulnerable `sub_41CF20` function without input sanitization. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity exploitation requiring only low-privilege credentials - a realistic threshold on consumer routers commonly deployed with default or weak passwords. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk above what the moderate CVSS score of 6.3 suggests; no public exploit identified at time of analysis maps to confirmed active exploitation (not in CISA KEV).

Command injection in D-Link DWR-M920 router firmware versions 1.1.50 and 1.1.70 allows a low-privileged, remote-authenticated attacker to inject OS commands via the action_value parameter in the SMS management endpoint /boafrm/formSmsManage. The vulnerability resides in the C function sub_41C8E8 and stems from unsanitized user input being passed directly to a command interpreter (CWE-77). A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation despite the absence of CISA KEV listing.

Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows authenticated remote attackers to corrupt memory via the Time parameter passed to the sprintf function in /httpd_debug.asp. Publicly available exploit code exists on GitHub, and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privilege requirement and no user interaction. The vulnerability targets an embedded networking appliance commonly deployed at SMB and branch-office perimeters, increasing exposure risk where the management interface is reachable.

Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by manipulating the 'str' parameter in /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges per the CVSS 4.0 vector. The original researcher advisory notes contradictory parameter names, introducing some uncertainty about the exact trigger field.

Weak default credential generation in the D-Link DWR-X1820 router exposes administrative access to adjacent-network attackers who can derive the device password from its IMEI number. All devices running firmware prior to 1.00B16CP are affected when users have not changed the factory-set password - a common real-world condition for consumer-grade routers. An attacker with knowledge of the IMEI-to-password derivation algorithm and physical or logical access to the IMEI (e.g., from the device label) can authenticate to the router admin interface without prior credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ip_address argument passed to the portForward function without sanitization. A public proof-of-concept is available on GitHub, lowering the skill bar for exploitation. No CISA KEV listing exists, but EPSS places this at the 66th percentile, indicating greater exploitation likelihood than two-thirds of all tracked CVEs.

Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the ip_address parameter in the /goform/singlePortForward endpoint. The root cause is the sub_445E7C function passing unsanitized user input directly to a system command (CWE-77), and a proof-of-concept exploit has been publicly disclosed on GitHub. No active exploitation has been confirmed by CISA KEV at time of analysis, though the EPSS score places this CVE at the 66th percentile for exploitation likelihood.

Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to execute arbitrary OS commands by manipulating input passed to the sub_445E7C function via the /goform/formDMZ.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, confirmed by VulDB and referenced in EUVD-2026-29345. No vendor patch has been identified at time of analysis, and the device's age and regional positioning suggest it may be unsupported, leaving affected deployments permanently exposed absent compensating controls.

OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated administrators to execute arbitrary system commands via unsanitized input to multiple CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) in /cgi-bin/system_mgr.cgi. CVSS 5.1 reflects high-privileged access requirement (PR:H) mitigating network-accessible attack vector; however, the ability to inject OS commands via CGI endpoints creates significant risk in multi-user or compromised-admin scenarios. No public exploit code or active exploitation confirmed at time of analysis.

OS command injection in D-Link DNS-320 2.06B01 webfile_mgr.cgi allows remote authenticated attackers with high privileges to execute arbitrary commands through manipulated file operation parameters (delete, rename, copy, move, chmod, chown). Publicly available exploit code exists; CVSS 2.0 reflects high privilege requirement and limited confidentiality/integrity impact on the vulnerable system only.

OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated attackers with high privileges to execute arbitrary system commands via multiple CGI parameters in /cgi-bin/network_mgr.cgi (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit). Publicly available exploit code exists and the vulnerability has been documented with proof-of-concept on GitHub.

Buffer overflow in D-Link DCS-935L camera firmware versions up to 1.10.01 allows authenticated remote attackers to achieve complete system compromise via crafted AdminPassword parameter to the HNAP service. Public exploit code exists on GitHub (0xcc12138/DCS-935L-HNAP-Service-CVE), demonstrating weaponization of this vulnerability. CVSS 4.0 score of 7.4 with CVSS:4.0/E:P confirms proof-of-concept exploitation. While authentication is required (PR:L), the low attack complexity (AC:L) and network attack vector (AV:N) combined with publicly available exploit code make this a practical remote exploitation risk for devices exposed to untrusted networks or compromised accounts.

Command injection in D-Link DCS-932L v2.18.01 allows remote unauthenticated attackers to execute arbitrary system commands via the LightSensorControl parameter in the /bin/alphapd binary. CVSS 7.3 indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, though EPSS score of 0.15% (35th percentile) suggests low observed exploitation probability. No CISA KEV listing or confirmed active exploitation. Publicly documented vulnerability details exist on GitHub, increasing risk of future exploitation attempts against this end-of-life IoT camera model.

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 enables authenticated remote code execution via crafted input to the /user_group.asp CGI handler. Attackers with high-privilege (administrator) credentials can exploit the unsafe sprintf function to achieve arbitrary code execution with complete system compromise. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation despite the high-privilege requirement.

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code via crafted 'Name' parameter to /url_member.asp in the web management interface. Public exploit code exists on GitHub, demonstrating active proof-of-concept availability. EPSS data unavailable; CVSS 7.2 reflects high impact but limited by requirement for high-privilege (admin) authentication, reducing real-world urgency for most organizations unless admin credentials are compromised or insider threat exists.

Buffer overflow in D-Link DI-8100 router (firmware 16.07.26A1) allows authenticated remote attackers to execute arbitrary code or crash the device via crafted HTTP requests to the /tggl.asp endpoint. The vulnerability affects the tggl_asp function's Name parameter handling. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation for attackers with valid router credentials.

Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis.

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version.

Stack-based buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated remote attackers with high privileges to execute arbitrary code via malformed ID parameter to yyxz.asp administrative interface. Public exploit code exists on GitHub, demonstrating reliable exploitation. CVSS 7.3 (High) reflects network attack vector but requires admin-level authentication, limiting real-world exposure to compromised credentials or insider scenarios.

Hardcoded telnet backdoor in D-Link DIR-456U Hardware Revision A1 firmware grants remote unauthenticated attackers root shell access using static credentials ('Alphanetworks' / 'whdrv01_dlob_dir456U'). The telnet daemon launches automatically at boot via /etc/init0.d/S80telnetd.sh and validates credentials through strcmp() comparison against hardcoded values in /etc/config/image_sign. Device is End-of-Life with no patches forthcoming. CVSS 9.8 reflects network-accessible unauthenticated remote code execution, though exploitation requires local network access to telnet service.

Remote root shell access via hardcoded telnet backdoor in D-Link DIR-600L Hardware Revision A1 allows network-adjacent attackers to authenticate with publicly known credentials ('Alphanetworks' / 'wrgn35_dlwbr_dir600l') and obtain full administrative control. The backdoor telnet daemon launches automatically at boot with static credentials stored in /etc/alpha_config/image_sign. The device is End-of-Life with no patches forthcoming, creating permanent exposure for deployed units. EPSS data not available; no CISA KEV listing identified, though the trivial exploitation complexity (CVSS AC:L, PR:N) and public disclosure make exploitation highly likely once details are disseminated.

D-Link DIR-600L Hardware Revision B1 routers expose a hardcoded telnet backdoor granting unauthenticated remote attackers root shell access via static credentials ('Alphanetworks' / 'wrgn61_dlwbr_dir600L'). The vulnerability affects End-of-Life devices that will never receive patches, making permanent network isolation or replacement the only remediation options. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly documented credentials, this represents critical risk for any exposed device, though exploitation requires local network access despite the 'Network' attack vector classification.

Hardcoded telnet backdoor in D-Link DIR-605L Hardware Revision B2 firmware enables unauthenticated root access for remote attackers on the local network using static credentials 'Alphanetworks:wrgn76_dlwbr_dir605L'. The telnet daemon starts automatically at boot, validating credentials via strcmp() against hardcoded values in /etc/alpha_config/image_sign, granting complete administrative control to anyone who knows the password. This End-of-Life device will receive no security patches. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted disclosure rather than widespread exploitation campaigns.

Hardcoded credentials in D-Link DIR-605L Hardware Revision A1 firmware grant root-level telnet access to unauthenticated attackers on adjacent networks. The telnet daemon automatically starts at boot with username 'Alphanetworks' and static password 'wrgn35_dlwbr_dir605l', enabling complete device takeover including network traffic interception, configuration modification, and pivot attacks against internal networks. This End-of-Life product will receive no vendor patch, requiring immediate device replacement. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, with adjacent network attack vector reducing but not eliminating risk for home and small office deployments.

Weak password recovery in D-Link M60 up to version 1.20B02 allows remote attackers to compromise device authentication through manipulation of the /usr/bin/httpd binary, requiring high attack complexity but with publicly disclosed exploit code available. The vulnerability enables information disclosure and potential unauthorized access to device management functions despite the low CVSS score of 2.9 reflecting limited confidentiality impact.

Remote authenticated attackers can execute arbitrary code on D-Link DIR-825M routers (firmware 1.1.12) by sending specially crafted requests to the /boafrm/formWanConfigSetup endpoint with malicious submit-url parameters, triggering a buffer overflow in function sub_414BA8. Public proof-of-concept exploit code exists on GitHub (Kiciot/cve#3), significantly lowering exploitation barriers. While requiring authentication (PR:L), the network attack vector (AV:N) and low complexity (AC:L) enable remote compromise of affected devices with potential for complete device control (VC:H/VI:H/VA:H). No CISA KEV listing or EPSS data available at time of analysis.

Buffer overflow in D-Link DIR-825M 1.1.12 router allows authenticated remote attackers to achieve high-severity code execution via crafted submit-url parameter in VPN configuration interface. Public exploit code exists (CVSS 4.0 E:P) with technical details disclosed on GitHub, enabling remote compromise of router administrative functions by low-privileged authenticated users. CVSS 7.4 HIGH severity with network attack vector and low complexity indicates significant risk for internet-facing devices with default or weak credentials.

Remote code execution in D-Link DI-8100 router firmware 16.07.26A1 allows unauthenticated attackers to compromise the device via buffer overflow in the CGI endpoint. The vulnerability resides in the tgfile.htm CGI handler where inadequate input validation of the 'fn' parameter enables attackers to overflow a stack or heap buffer. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation against internet-exposed devices. CVSS 8.9 (Critical) with network vector, low complexity, and no privileges required indicates high real-world risk for exposed D-Link DI-8100 routers.

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code remotely via crafted file extension names. The vulnerability affects the file_exten.asp File Extension Handler component, with a publicly available exploit (E:P in CVSS vector). While requiring high-privilege access (PR:H), successful exploitation grants complete system control (VC:H/VI:H/VA:H), and the attack complexity is low (AC:L). No CISA KEV listing indicates targeted rather than widespread exploitation despite public POC availability.

Stack-based buffer overflow in D-Link DIR-825 firmware 3.00b32's nmbd NetBIOS service allows adjacent network attackers to achieve complete device compromise without authentication. Public exploit code exists (SSVC: POC confirmed), though EPSS probability remains low (0.03%, 7th percentile) indicating limited observed exploitation attempts. This vulnerability affects end-of-life hardware no longer receiving vendor security updates, creating permanent risk for deployed devices.

Command injection in D-Link DIR-822 A_101 udhcpd DHCP service allows remote unauthenticated attackers to execute arbitrary commands via a malicious Hostname parameter in DHCP requests. The vulnerability affects an end-of-life product with publicly disclosed exploit code available, creating significant risk for organizations unable to migrate away from legacy hardware.

Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.

Cross-site scripting (XSS) in D-Link DSL-2740R EU_01.15 allows authenticated remote attackers with high privileges to inject malicious scripts via the Wireless Network Name parameter in the Wireless Setup Section, affecting data integrity when a user views the compromised configuration. The vulnerability requires user interaction and administrative credentials, limiting its real-world exploitation scope despite publicly available exploit code.

Stored or reflected cross-site scripting (XSS) in D-Link DGS-3420 firmware 1.50.018 allows authenticated remote attackers to inject malicious scripts via the System Name parameter on the System Information Settings Page. The vulnerability requires high-level administrative privileges and user interaction (UI:R), limiting exploitation to scenarios where an authenticated admin visits a malicious page or clicks a crafted link. Publicly available exploit code exists; CVSS 4.5 reflects the requirement for admin access and user interaction, though the impact is information disclosure or session hijacking potential through XSS.

Brute-force protection bypass in D-Link DWM-222W USB Wi-Fi Adapter allows remote unauthenticated attackers to perform unlimited authentication attempts against the device's login interface. The vulnerability eliminates rate limiting controls, enabling adversaries to systematically guess credentials until device takeover is achieved. CVSS 8.7 reflects the high integrity impact (VI:H) from potential device compromise, though no public exploit code has been identified and CISA has not flagged active exploitation.

Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in POST request handling at /goform/formAdvanceSetup endpoint, where insufficient input validation of the 'webpage' parameter triggers memory corruption. Publicly available exploit code exists. This router model is end-of-life with no vendor support.

Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The formSetRoute function improperly validates the curTime parameter, enabling memory corruption attacks. Publicly available exploit code exists. This vulnerability affects end-of-life hardware no longer supported by D-Link, leaving no vendor remediation pathway.

Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. Exploitation occurs through POST request manipulation of the curTime parameter in /goform/formSetPassword endpoint. This end-of-life product receives no vendor support, and publicly available exploit code exists. Attack requires low-privilege authentication (CVSS PR:L) but no user interaction, enabling straightforward remote exploitation once credentials are obtained.

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution via POST request manipulation. The formSetLog function in /goform/formSetLog improperly handles the curTime parameter, enabling memory corruption. Publicly available exploit code exists. This end-of-life product receives no vendor support or security updates.

Buffer overflow in D-Link DIR-605L 2.13B01 router enables remote code execution via POST request manipulation of curTime parameter in formSetDDNS function. Publicly available exploit code exists. Affected device is end-of-life with no vendor support. Authenticated attacker with low-privilege network access can achieve complete system compromise (high confidentiality, integrity, availability impact per CVSS 4.0 scoring).

Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to achieve arbitrary code execution via crafted POST requests to /goform/formAdvNetwork endpoint. Exploitation manipulates the curTime parameter in the formAdvNetwork function, triggering memory corruption. This end-of-life device receives no vendor support; publicly available exploit code exists. Affected hardware presents elevated risk in legacy network environments where administrative credentials may be compromised.

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated attackers to achieve remote code execution via crafted curTime parameter in formSetMACFilter POST handler. This end-of-life product receives no vendor support. Publicly available exploit code exists. Attackers with low-privilege network access can compromise device confidentiality and integrity remotely without user interaction.

Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to execute arbitrary code via the formAdvFirewall function in POST request handler. Exploitation occurs through manipulation of the curTime parameter in /goform/formAdvFirewall endpoint. Publicly available exploit code exists. This end-of-life product receives no vendor security support, requiring immediate device replacement for affected deployments.

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution through malicious curTime parameter in formVirtualServ function via POST request to /goform/formVirtualServ endpoint. Affects end-of-life product with no vendor support. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling remote compromise of device confidentiality and integrity.

OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.

Stack-based buffer overflow in D-Link DIR-645 router (versions 1.01, 1.02, 1.03) via hedwigcgi_main function in /cgi-bin/hedwig.cgi allows authenticated remote attackers to achieve complete system compromise. Exploitation requires low-privilege credentials but no user interaction. Publicly available exploit code exists. Product is end-of-life with no vendor support, making remediation limited to device replacement or network isolation.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions through malformed vlan_name parameter submitted to /shut_set.asp endpoint. Improper input validation in VLAN configuration interface permits memory corruption leading to system availability disruption. CVSS 7.5 reflects network-accessible attack requiring no user interaction or credentials. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).

Stack-based buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service via malformed HTTP GET request to /user_group.asp endpoint. Attacker sends crafted name, mem, pri, or attr parameters triggering memory corruption and device crash. CVSS 7.5 High severity reflects network-accessible attack requiring no privileges or user interaction. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS <1%).

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions via malformed input to the /tggl.asp endpoint. The vulnerability stems from inadequate input validation, allowing network-accessible exploitation without authentication or user interaction. Exploitation results in high-impact availability loss with no confidentiality or integrity compromise. No public exploit identified at time of analysis. EPSS score indicates low observed exploitation activity.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions through malformed wans parameter input to the qos.asp Quality-of-Service configuration endpoint. Exploitation requires no user interaction and achieves complete availability impact against network infrastructure device. Low observed exploitation activity (EPSS 0.02%, 5th percentile); no public exploit identified at time of analysis.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks through malformed input to the name parameter at /qos_type_asp.asp endpoint. Attackers can trigger service disruption without authentication or user interaction by exploiting insufficient input validation in the QoS management interface. EPSS indicates low observed exploitation activity; no public exploit identified at time of analysis.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial of service attacks. Attackers can trigger memory corruption by submitting oversized 's' parameter values to the pppoe_list_opt.asp endpoint without authentication, causing device unavailability. CVSS 7.5 severity reflects network-accessible attack vector with low complexity. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 qj.asp endpoint enables unauthenticated remote denial-of-service attacks through malformed HTTP requests. Insufficient input validation allows attackers to trigger memory corruption, crashing the device and disrupting network services. Confidentiality and integrity remain intact per CVSS scoring, but availability impact is severe. No public exploit identified at time of analysis. EPSS indicates low observed exploitation activity.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks through crafted HTTP GET requests to /web_keyword.asp endpoint. Attackers exploit improper input validation in name, en, time, mem_gb2312, and mem_utf8 parameters to trigger memory corruption, causing device unavailability. CVSS 7.5 (High) severity reflects network-accessible attack vector requiring no user interaction or privileges. No public exploit identified at time of analysis; low observed exploitation activity.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks through malformed name parameter in /thd_group.asp endpoint. Improper input validation triggers stack-based buffer overflow, causing device crashes or service disruption without requiring user interaction. Attack vector is network-accessible with low complexity. No public exploit identified at time of analysis.

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service via malformed custom_error parameter to /user.asp endpoint. Attackers can crash device remotely without credentials by exploiting stack-based buffer overflow (CWE-121). CVSS 7.5 reflects network-accessible, low-complexity attack requiring no user interaction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).