156
CVEs
24
Critical
94
High
0
KEV
76
PoC
101
Unpatched C/H
11.5%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
24
HIGH
94
MEDIUM
17
LOW
21
Monthly CVE Trend
Affected Products (30)
PHP
101
Dir 619l Firmware
64
Dir 816 Firmware
62
Dir 605l Firmware
59
Dir 823G Firmware
58
Dir 878 Firmware
39
N A
35
Dir 513 Firmware
34
Dir 882 Firmware
27
Dns 320
27
Dns 320 Firmware
27
Dns 320Lw Firmware
25
Dns 325 Firmware
25
Dns 327L Firmware
24
Dnr 326 Firmware
24
Dns 340l
24
Dns 340L Firmware
24
Dar 7000 Firmware
23
Dns 320L Firmware
23
Dwr M960 Firmware
22
Dns 345
22
Dir 850L Firmware
22
Dsl 3782 Firmware
22
Dnr 322L Firmware
22
Dns 345 Firmware
22
Dns 1550 04 Firmware
21
Dns 326 Firmware
21
Dns 321 Firmware
21
Dns 120 Firmware
21
Dns 1100 4 Firmware
21
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86296 | Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices. | CRITICAL | 9.3 | 1.3% | 68 |
PoC
No patch
|
| CVE-2026-90680 | Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided. | CRITICAL | 9.4 | 0.5% | 68 |
PoC
No patch
|
| CVE-2026-82688 | OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated. | HIGH | 8.5 | 2.8% | 65 |
PoC
No patch
|
| CVE-2026-85224 | OS command injection in D-Link DNS-320 ShareCenter firmware 2.06B01 allows a remote authenticated attacker to execute arbitrary operating system commands by supplying a crafted value for the fileurl parameter in the File Sharing CGI handler (/cgi/file_sharing.cgi). The vulnerability carries a CVSS 4.0 base score of 8.5 with high-privilege requirement but yields full system-level compromise on success, including subsequent-system impact. A public exploit has been disclosed, materially lowering the barrier to exploitation for any remaining deployments of this legacy NAS appliance. | HIGH | 8.5 | 2.2% | 65 |
PoC
No patch
|
| CVE-2026-85223 | OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the `callback_url` or `sync_interval` arguments passed to the `/cgi-bin/dropbox.cgi` CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. No patch has been identified at time of analysis, and the DNS-340L is likely an end-of-life product with no vendor remediation roadmap. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-82691 | OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk. | HIGH | 8.5 | 2.1% | 65 |
PoC
No patch
|
| CVE-2026-90699 | OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-7853 | Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-7854 | Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2018-25358 | D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-82593 | Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 64 |
PoC
No patch
|
| CVE-2026-86510 | Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-86509 | Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-82689 | OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched. | HIGH | 8.6 | 2.4% | 63 |
PoC
No patch
|
| CVE-2026-82692 | OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks. | HIGH | 8.6 | 2.4% | 63 |
PoC
No patch
|