104
CVEs
10
Critical
55
High
0
KEV
93
PoC
64
Unpatched C/H
1.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
55
MEDIUM
15
LOW
24
Monthly CVE Trend
Affected Products (30)
Dns 320
27
Dns 340l
24
Dns 345
22
Dns 327l
21
Dns 320l
20
Dns 320lw
18
Dns 315l
18
Dns 726 4
18
Dnr 322l
18
Dns 1200 05
18
Dns 1100 4
18
Dns 343
18
Dns 323
18
Dnr 326
18
Dns 1550 04
18
Dns 326
18
Dns 321
18
Dns 325
18
Dns 120
18
Dnr 202l
18
Dir 816
8
PHP
7
Dsl 3782 Firmware
7
Di 8100
6
Dir 513
6
Dir 823G Firmware
5
Dir 605l Firmware
4
Dwr M921
4
Dcs 825L Firmware
3
Dnr 326 Firmware
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-4183 | Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wireless configuration interface (/goform/form2WlanBasicSetup.cgi). A publicly available proof-of-concept exploit exists, allowing remote attackers without authentication to achieve complete system compromise. The vulnerability affects end-of-life products no longer supported by D-Link, making patches unlikely. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-4182 | Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to achieve full system compromise without authentication. A public proof-of-concept exploit is available on GitHub, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-4184 | Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available on GitHub, making this vulnerability actively exploitable. However, D-Link no longer supports this product, meaning no patch will be released. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-86296 | Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices. | CRITICAL | 9.3 | 1.3% | 68 |
PoC
No patch
|
| CVE-2026-90680 | Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided. | CRITICAL | 9.4 | 0.5% | 68 |
PoC
No patch
|
| CVE-2026-90703 | Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis. | HIGH | 8.5 | 2.8% | 65 |
PoC
No patch
|
| CVE-2026-82688 | OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated. | HIGH | 8.5 | 2.8% | 65 |
PoC
No patch
|
| CVE-2026-85224 | OS command injection in D-Link DNS-320 ShareCenter firmware 2.06B01 allows a remote authenticated attacker to execute arbitrary operating system commands by supplying a crafted value for the fileurl parameter in the File Sharing CGI handler (/cgi/file_sharing.cgi). The vulnerability carries a CVSS 4.0 base score of 8.5 with high-privilege requirement but yields full system-level compromise on success, including subsequent-system impact. A public exploit has been disclosed, materially lowering the barrier to exploitation for any remaining deployments of this legacy NAS appliance. | HIGH | 8.5 | 2.2% | 65 |
PoC
No patch
|
| CVE-2026-85223 | OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the `callback_url` or `sync_interval` arguments passed to the `/cgi-bin/dropbox.cgi` CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. No patch has been identified at time of analysis, and the DNS-340L is likely an end-of-life product with no vendor remediation roadmap. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-82691 | OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk. | HIGH | 8.5 | 2.1% | 65 |
PoC
No patch
|
| CVE-2026-90699 | OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-4181 | Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (firmware version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-7853 | Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-7854 | Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-4213 | Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cgi-bin/gui_mgr.cgi endpoint allows remote authenticated attackers to achieve code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected firmware versions are dated up to February 5, 2026. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|