32
CVEs
4
Critical
21
High
0
KEV
24
PoC
25
Unpatched C/H
0.0%
Patch Rate
1.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
21
MEDIUM
2
LOW
5
Monthly CVE Trend
Affected Products (30)
PHP
101
Dir 619l Firmware
64
Dir 816 Firmware
62
Dir 605l Firmware
59
Dir 823G Firmware
58
Dir 878 Firmware
39
N A
35
Dir 513 Firmware
34
Dir 882 Firmware
27
Dns 320
27
Dns 320 Firmware
27
Dns 320Lw Firmware
25
Dns 325 Firmware
25
Dns 327L Firmware
24
Dnr 326 Firmware
24
Dns 340l
24
Dns 340L Firmware
24
Dar 7000 Firmware
23
Dns 320L Firmware
23
Dwr M960 Firmware
22
Dns 345
22
Dir 850L Firmware
22
Dsl 3782 Firmware
22
Dnr 322L Firmware
22
Dns 345 Firmware
22
Dns 1550 04 Firmware
21
Dns 326 Firmware
21
Dns 321 Firmware
21
Dns 120 Firmware
21
Dns 1100 4 Firmware
21
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86296 | Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices. | CRITICAL | 9.3 | 1.3% | 68 |
PoC
No patch
|
| CVE-2026-90680 | Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided. | CRITICAL | 9.4 | 0.5% | 68 |
PoC
No patch
|
| CVE-2026-82688 | OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated. | HIGH | 8.5 | 2.8% | 65 |
PoC
No patch
|
| CVE-2026-85224 | OS command injection in D-Link DNS-320 ShareCenter firmware 2.06B01 allows a remote authenticated attacker to execute arbitrary operating system commands by supplying a crafted value for the fileurl parameter in the File Sharing CGI handler (/cgi/file_sharing.cgi). The vulnerability carries a CVSS 4.0 base score of 8.5 with high-privilege requirement but yields full system-level compromise on success, including subsequent-system impact. A public exploit has been disclosed, materially lowering the barrier to exploitation for any remaining deployments of this legacy NAS appliance. | HIGH | 8.5 | 2.2% | 65 |
PoC
No patch
|
| CVE-2026-85223 | OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the `callback_url` or `sync_interval` arguments passed to the `/cgi-bin/dropbox.cgi` CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. No patch has been identified at time of analysis, and the DNS-340L is likely an end-of-life product with no vendor remediation roadmap. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-82691 | OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk. | HIGH | 8.5 | 2.1% | 65 |
PoC
No patch
|
| CVE-2026-90699 | OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|
| CVE-2026-82593 | Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 64 |
PoC
No patch
|
| CVE-2026-86510 | Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-86509 | Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-82689 | OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched. | HIGH | 8.6 | 2.4% | 63 |
PoC
No patch
|
| CVE-2026-82692 | OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks. | HIGH | 8.6 | 2.4% | 63 |
PoC
No patch
|
| CVE-2026-91001 | Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-82690 | OS command injection in D-Link DNS-327L and DNS-340L NAS devices (all firmware versions through 20260717) allows a remote authenticated attacker to execute arbitrary operating system commands by supplying crafted input to the f_dev parameter of the /cgi-bin/ve_mgr.cgi endpoint. A proof-of-concept exploit is publicly available, materially lowering the barrier for post-authentication abuse. Full OS-level compromise - including persistent backdoor installation and wholesale data exfiltration from attached storage - is achievable; this CVE is not currently listed in CISA KEV, so widespread active exploitation has not been confirmed. | HIGH | 8.5 | 2.1% | 62 |
PoC
No patch
|
| CVE-2026-90703 | Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis. | HIGH | 8.5 | 2.8% | 62 |
PoC
No patch
|