D-Link
Monthly
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin. Part of a family of 15+ critical buffer overflows in this router.
D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup. [CVSS 9.8 CRITICAL]
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formDeviceReboot. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvFirewall. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter. Part of a family of 15+ critical buffer overflows in this router.
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. [CVSS 8.2 HIGH]
D-Link products versions 2.0.0 and earlier are vulnerable to server-side request forgery (SSRF) that allows authenticated attackers to make arbitrary HTTP requests from the affected system. This MEDIUM severity vulnerability requires valid credentials but enables attackers to bypass network controls and potentially access internal resources or services. No patch is currently available.
D-Link DCS-931L camera firmware versions up to 1.13.0 contain a command injection vulnerability in the /setSystemAdmin endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the AdminID parameter. Public exploit code exists for this vulnerability, though the affected devices are no longer supported by D-Link. An attacker with administrative access could achieve remote code execution on vulnerable cameras.
Command injection in D-Link DCS-933L firmware up to version 1.14.11 allows authenticated remote attackers to execute arbitrary commands through the AdminID parameter in the /setSystemAdmin endpoint. Public exploit code exists for this vulnerability, which affects only end-of-life devices no longer receiving security updates. An attacker with valid credentials can achieve remote code execution with limited system privileges.
Di-7100G C1 Firmware versions up to 24.04.18d1 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in D-Link DI-7100G C1 firmware version 24.04.18D1 allows authenticated remote attackers to execute arbitrary commands through manipulation of the usb_username parameter in the set_jhttpd_info function. Public exploit code exists for this vulnerability, and no patch is currently available. The medium-severity flaw requires valid credentials but can be exploited over the network with minimal complexity.
Command injection in D-Link DWR-M921 firmware via the fota_url parameter allows authenticated remote attackers to execute arbitrary commands with network access. The vulnerability affects firmware version 1.1.50 and has public exploit code available. A patch is not currently available.
D-Link DWR-M921 firmware versions up to 1.1.50 contain a command injection vulnerability in the LTE firmware update function that allows authenticated remote attackers to execute arbitrary commands via a manipulated fota_url parameter. Public exploit code is available for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials could achieve remote code execution on affected devices.
Command injection in D-Link DIR-600 firmware through the ssdp.cgi file allows remote attackers to execute arbitrary commands by manipulating HTTP parameters (HTTP_ST, REMOTE_ADDR, REMOTE_PORT, SERVER_ID). Public exploit code exists for this vulnerability, though it affects only unsupported product versions. The attack requires high-level privileges but has low complexity and impacts confidentiality, integrity, and availability.
D-Link DIR-823X routers contain an OS command injection vulnerability in the /goform/set_mac_clone endpoint that allows remote attackers with high privileges to execute arbitrary commands through manipulation of the mac parameter. Public exploit code exists for this vulnerability, which affects confidentiality, integrity, and availability. No patch is currently available.
D-Link DIR-823X firmware contains an OS command injection vulnerability in the /goform/set_password endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the http_passwd parameter. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker could leverage this to compromise the affected device with limited confidentiality, integrity, and availability impact.
D-Link DIR-823X routers are vulnerable to remote command injection through the Web Management Interface's /goform/set_ac_server endpoint, allowing unauthenticated attackers to execute arbitrary OS commands. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. A patch is not currently available, leaving affected devices exposed until remediation.
D-Link DIR-823X firmware versions up to 250416 contain an OS command injection vulnerability in the IPv6 configuration endpoint that allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires administrative privileges but can be executed over the network with no user interaction required.
D-Link DIR-605L and DIR-619L routers expose sensitive information through the DHCP Connection Status Handler via unauthenticated network requests, with public exploit code available. Affected devices running firmware versions 2.06B01 and 2.13B01 can leak configuration data to remote attackers without authentication, though impact is limited to information disclosure. No patch is available as these router models are end-of-life and no longer supported by D-Link.
Information disclosure in D-Link DIR-605L and DIR-619L routers allows unauthenticated remote attackers to access sensitive DHCP client information through an unspecified manipulation of the DHCP Client Information Handler component. Public exploit code exists for this vulnerability, though patches are unavailable since these device models are no longer supported by D-Link.
D-Link DIR-605L and DIR-619L routers (firmware versions 2.06B01/2.13B01) expose sensitive information through an unauthenticated remote manipulation of the WiFi Setting Handler component. Public exploit code is available for this vulnerability, and affected devices are no longer receiving security updates from D-Link. An attacker can remotely retrieve configuration data without authentication or user interaction.
Dsl-6641K Firmware versions up to n8.tr069.20131126 is affected by cross-site scripting (xss) (CVSS 2.4).
A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interface. [CVSS 2.4 LOW]
Dir-823X Firmware versions up to 250416 is affected by improper restriction of excessive authentication attempts (CVSS 3.7).
Command injection in D-Link DWR-M961 firmware version 1.1.47 allows authenticated remote attackers to execute arbitrary commands via manipulation of the action_value parameter in the SMS message handling function. The vulnerability requires valid credentials but no user interaction, and public exploit code is available. Affected systems can suffer unauthorized command execution, data theft, and potential device compromise.
Command injection in D-Link DWR-M961 firmware through the /boafrm/formLtefotaUpgradeFibocom endpoint allows authenticated remote attackers to execute arbitrary commands by manipulating the fota_url parameter. Public exploit code exists for this vulnerability, and no patch is currently available.
Command injection in D-Link DWR-M961 firmware (version 1.1.47) allows unauthenticated remote attackers to execute arbitrary commands through the fota_url parameter in the LTE firmware upgrade function. Public exploit code exists for this vulnerability, which requires low privileges but no user interaction to exploit. No patch is currently available for affected devices.
D-Link DIR-823X routers are vulnerable to remote command injection through the lan_gateway parameter in the /goform/set_mode function, allowing authenticated attackers to execute arbitrary OS commands. Public exploit code is available for this vulnerability, and affected devices are no longer receiving security updates from the vendor. The attack requires network access and valid credentials but has a low CVSS score of 6.3 due to limited impact scope.
A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. [CVSS 2.4 LOW]
Dcs-700L Firmware versions up to 1.03.09 contains a vulnerability that allows attackers to command injection (CVSS 4.7).
Dir-823X Firmware versions up to 250126 contains a vulnerability that allows attackers to command injection (CVSS 7.3).
D-Link DIR-895L router has command injection in the DHCP daemon via the hostname parameter during lease renewal. Any device requesting a DHCP lease with a malicious hostname achieves root code execution on the router. PoC available.
Command injection in D-Link DI-8200G firmware version 17.12.20A1 via the /upgrade_filter.asp path parameter allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and valid credentials but no user interaction.
Dir-605L Firmware versions up to 6.02cn02 is affected by missing authentication for critical function (CVSS 6.8).
Command injection in the SSDP Request Handler (ssdpcgi_main function) of D-Link DIR-806A firmware 100CNb11 allows remote authenticated attackers to execute arbitrary commands with low integrity and availability impact. Publicly available exploit code exists, but the vulnerability affects only end-of-life firmware with minimal real-world exploitation probability (EPSS 0.11%) due to low privilege requirements and limited scope of impact.
Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the `cmd` parameter of the `/msp_info.htm?flag=cmd` web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary commands via the fota_url parameter in the /boafrm/formLtefotaUpgradeQuectel endpoint. Public exploit code is available, though EPSS exploitation probability remains low at 0.20% percentile, suggesting limited real-world exploitation despite proof-of-concept availability.
Remote command injection in D-Link DWR-M920 routers allows authenticated attackers with low privileges to execute arbitrary commands on the device. The flaw exists in the fota_url parameter of the formLtefotaUpgradeFibocom handler in firmware versions up to 1.1.50. Exploit code is publicly available, but no evidence of active exploitation exists, and EPSS suggests low exploitation probability.
Remote command injection in D-Link DCS-930L firmware version 1.15.04 allows authenticated attackers to execute arbitrary system commands via the AdminID parameter of the /setSystemAdmin endpoint. Exploit code is publicly available, but the device is end-of-life and unsupported, so no official patch is expected. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Command injection in D-Link DIR-823X firmware allows remote authenticated attackers to execute arbitrary OS commands via the ppp_username parameter in the set_wan_settings endpoint. A proof-of-concept exploit is publicly available, but no active exploitation is confirmed. The vulnerability impacts firmware versions up to 202504
A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.
A vulnerability was identified in D-Link DIR-852 1.00.cgi. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DWR-M920 1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-822K 1.00. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta.cgi. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.2% and no vendor patch available.
Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink. Rated medium severity (CVSS 5.3). No vendor patch available.
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Command injection in D-Link DI-7001 MINI firmware versions 19.09.19A1 and 24.04.18B1 allows authenticated remote attackers to execute arbitrary commands via the cmd parameter in /msp_info.htm. The vulnerability has a public exploit available, though the extremely low CVSS score (2.1) and EPSS percentile (24th) indicate limited real-world exploitability despite network accessibility, as exploitation requires valid login credentials and results in low-impact information disclosure rather than system compromise.
OS command injection in D-Link DAP-2695 firmware 2.00RC13 allows high-privileged remote attackers to execute arbitrary commands through the Firmware Update Handler function sub_4174B0. The vulnerability carries a low real-world risk despite network-accessible attack vector due to requiring administrative credentials (PR:H) and affecting only end-of-life hardware. Publicly available exploit code exists, though EPSS exploitation probability remains minimal at 0.09th percentile.
Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.
OS command injection in D-Link DI-7001 MINI firmware 24.04.18B1 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the path argument in /upgrade_filter.asp. Public exploit code is available, though the CVSS 2.1 score and 0.07% EPSS percentile indicate limited real-world exploitation likelihood despite the vulnerability's remote network accessibility.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin. Part of a family of 15+ critical buffer overflows in this router.
D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup. [CVSS 9.8 CRITICAL]
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formDeviceReboot. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvFirewall. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr. Part of a family of 15+ critical buffer overflows in this router.
Stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter. Part of a family of 15+ critical buffer overflows in this router.
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. [CVSS 8.2 HIGH]
D-Link products versions 2.0.0 and earlier are vulnerable to server-side request forgery (SSRF) that allows authenticated attackers to make arbitrary HTTP requests from the affected system. This MEDIUM severity vulnerability requires valid credentials but enables attackers to bypass network controls and potentially access internal resources or services. No patch is currently available.
D-Link DCS-931L camera firmware versions up to 1.13.0 contain a command injection vulnerability in the /setSystemAdmin endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the AdminID parameter. Public exploit code exists for this vulnerability, though the affected devices are no longer supported by D-Link. An attacker with administrative access could achieve remote code execution on vulnerable cameras.
Command injection in D-Link DCS-933L firmware up to version 1.14.11 allows authenticated remote attackers to execute arbitrary commands through the AdminID parameter in the /setSystemAdmin endpoint. Public exploit code exists for this vulnerability, which affects only end-of-life devices no longer receiving security updates. An attacker with valid credentials can achieve remote code execution with limited system privileges.
Di-7100G C1 Firmware versions up to 24.04.18d1 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in D-Link DI-7100G C1 firmware version 24.04.18D1 allows authenticated remote attackers to execute arbitrary commands through manipulation of the usb_username parameter in the set_jhttpd_info function. Public exploit code exists for this vulnerability, and no patch is currently available. The medium-severity flaw requires valid credentials but can be exploited over the network with minimal complexity.
Command injection in D-Link DWR-M921 firmware via the fota_url parameter allows authenticated remote attackers to execute arbitrary commands with network access. The vulnerability affects firmware version 1.1.50 and has public exploit code available. A patch is not currently available.
D-Link DWR-M921 firmware versions up to 1.1.50 contain a command injection vulnerability in the LTE firmware update function that allows authenticated remote attackers to execute arbitrary commands via a manipulated fota_url parameter. Public exploit code is available for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials could achieve remote code execution on affected devices.
Command injection in D-Link DIR-600 firmware through the ssdp.cgi file allows remote attackers to execute arbitrary commands by manipulating HTTP parameters (HTTP_ST, REMOTE_ADDR, REMOTE_PORT, SERVER_ID). Public exploit code exists for this vulnerability, though it affects only unsupported product versions. The attack requires high-level privileges but has low complexity and impacts confidentiality, integrity, and availability.
D-Link DIR-823X routers contain an OS command injection vulnerability in the /goform/set_mac_clone endpoint that allows remote attackers with high privileges to execute arbitrary commands through manipulation of the mac parameter. Public exploit code exists for this vulnerability, which affects confidentiality, integrity, and availability. No patch is currently available.
D-Link DIR-823X firmware contains an OS command injection vulnerability in the /goform/set_password endpoint that allows remote attackers with high privileges to execute arbitrary commands by manipulating the http_passwd parameter. Public exploit code exists for this vulnerability, and no patch is currently available. An authenticated attacker could leverage this to compromise the affected device with limited confidentiality, integrity, and availability impact.
D-Link DIR-823X routers are vulnerable to remote command injection through the Web Management Interface's /goform/set_ac_server endpoint, allowing unauthenticated attackers to execute arbitrary OS commands. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. A patch is not currently available, leaving affected devices exposed until remediation.
D-Link DIR-823X firmware versions up to 250416 contain an OS command injection vulnerability in the IPv6 configuration endpoint that allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires administrative privileges but can be executed over the network with no user interaction required.
D-Link DIR-605L and DIR-619L routers expose sensitive information through the DHCP Connection Status Handler via unauthenticated network requests, with public exploit code available. Affected devices running firmware versions 2.06B01 and 2.13B01 can leak configuration data to remote attackers without authentication, though impact is limited to information disclosure. No patch is available as these router models are end-of-life and no longer supported by D-Link.
Information disclosure in D-Link DIR-605L and DIR-619L routers allows unauthenticated remote attackers to access sensitive DHCP client information through an unspecified manipulation of the DHCP Client Information Handler component. Public exploit code exists for this vulnerability, though patches are unavailable since these device models are no longer supported by D-Link.
D-Link DIR-605L and DIR-619L routers (firmware versions 2.06B01/2.13B01) expose sensitive information through an unauthenticated remote manipulation of the WiFi Setting Handler component. Public exploit code is available for this vulnerability, and affected devices are no longer receiving security updates from D-Link. An attacker can remotely retrieve configuration data without authentication or user interaction.
Dsl-6641K Firmware versions up to n8.tr069.20131126 is affected by cross-site scripting (xss) (CVSS 2.4).
A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interface. [CVSS 2.4 LOW]
Dir-823X Firmware versions up to 250416 is affected by improper restriction of excessive authentication attempts (CVSS 3.7).
Command injection in D-Link DWR-M961 firmware version 1.1.47 allows authenticated remote attackers to execute arbitrary commands via manipulation of the action_value parameter in the SMS message handling function. The vulnerability requires valid credentials but no user interaction, and public exploit code is available. Affected systems can suffer unauthorized command execution, data theft, and potential device compromise.
Command injection in D-Link DWR-M961 firmware through the /boafrm/formLtefotaUpgradeFibocom endpoint allows authenticated remote attackers to execute arbitrary commands by manipulating the fota_url parameter. Public exploit code exists for this vulnerability, and no patch is currently available.
Command injection in D-Link DWR-M961 firmware (version 1.1.47) allows unauthenticated remote attackers to execute arbitrary commands through the fota_url parameter in the LTE firmware upgrade function. Public exploit code exists for this vulnerability, which requires low privileges but no user interaction to exploit. No patch is currently available for affected devices.
D-Link DIR-823X routers are vulnerable to remote command injection through the lan_gateway parameter in the /goform/set_mode function, allowing authenticated attackers to execute arbitrary OS commands. Public exploit code is available for this vulnerability, and affected devices are no longer receiving security updates from the vendor. The attack requires network access and valid credentials but has a low CVSS score of 6.3 due to limited impact scope.
A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. [CVSS 2.4 LOW]
Dcs-700L Firmware versions up to 1.03.09 contains a vulnerability that allows attackers to command injection (CVSS 4.7).
Dir-823X Firmware versions up to 250126 contains a vulnerability that allows attackers to command injection (CVSS 7.3).
D-Link DIR-895L router has command injection in the DHCP daemon via the hostname parameter during lease renewal. Any device requesting a DHCP lease with a malicious hostname achieves root code execution on the router. PoC available.
Command injection in D-Link DI-8200G firmware version 17.12.20A1 via the /upgrade_filter.asp path parameter allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and valid credentials but no user interaction.
Dir-605L Firmware versions up to 6.02cn02 is affected by missing authentication for critical function (CVSS 6.8).
Command injection in the SSDP Request Handler (ssdpcgi_main function) of D-Link DIR-806A firmware 100CNb11 allows remote authenticated attackers to execute arbitrary commands with low integrity and availability impact. Publicly available exploit code exists, but the vulnerability affects only end-of-life firmware with minimal real-world exploitation probability (EPSS 0.11%) due to low privilege requirements and limited scope of impact.
Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the `cmd` parameter of the `/msp_info.htm?flag=cmd` web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary commands via the fota_url parameter in the /boafrm/formLtefotaUpgradeQuectel endpoint. Public exploit code is available, though EPSS exploitation probability remains low at 0.20% percentile, suggesting limited real-world exploitation despite proof-of-concept availability.
Remote command injection in D-Link DWR-M920 routers allows authenticated attackers with low privileges to execute arbitrary commands on the device. The flaw exists in the fota_url parameter of the formLtefotaUpgradeFibocom handler in firmware versions up to 1.1.50. Exploit code is publicly available, but no evidence of active exploitation exists, and EPSS suggests low exploitation probability.
Remote command injection in D-Link DCS-930L firmware version 1.15.04 allows authenticated attackers to execute arbitrary system commands via the AdminID parameter of the /setSystemAdmin endpoint. Exploit code is publicly available, but the device is end-of-life and unsupported, so no official patch is expected. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Command injection in D-Link DIR-823X firmware allows remote authenticated attackers to execute arbitrary OS commands via the ppp_username parameter in the set_wan_settings endpoint. A proof-of-concept exploit is publicly available, but no active exploitation is confirmed. The vulnerability impacts firmware versions up to 202504
A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.
A vulnerability was identified in D-Link DIR-852 1.00.cgi. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DWR-M920 1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-822K 1.00. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta.cgi. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.2% and no vendor patch available.
Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink. Rated medium severity (CVSS 5.3). No vendor patch available.
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Command injection in D-Link DI-7001 MINI firmware versions 19.09.19A1 and 24.04.18B1 allows authenticated remote attackers to execute arbitrary commands via the cmd parameter in /msp_info.htm. The vulnerability has a public exploit available, though the extremely low CVSS score (2.1) and EPSS percentile (24th) indicate limited real-world exploitability despite network accessibility, as exploitation requires valid login credentials and results in low-impact information disclosure rather than system compromise.
OS command injection in D-Link DAP-2695 firmware 2.00RC13 allows high-privileged remote attackers to execute arbitrary commands through the Firmware Update Handler function sub_4174B0. The vulnerability carries a low real-world risk despite network-accessible attack vector due to requiring administrative credentials (PR:H) and affecting only end-of-life hardware. Publicly available exploit code exists, though EPSS exploitation probability remains minimal at 0.09th percentile.
Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.
OS command injection in D-Link DI-7001 MINI firmware 24.04.18B1 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the path argument in /upgrade_filter.asp. Public exploit code is available, though the CVSS 2.1 score and 0.07% EPSS percentile indicate limited real-world exploitation likelihood despite the vulnerability's remote network accessibility.