Dir-820l Firmware vulnerabilities

8 known vulnerabilities in Dir-820l Firmware from D-Link. 8 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Dir-820l Firmware: Improper Access Control

  CVE-2025-52079Oct 21, 2025D-Link

  The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.

• 8.0 High severity

  dir-820l_firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2024-51186Nov 11, 2024D-LinkEPSS 2.08%

  D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions.

• 7.5 High severity

  Dir-820l Firmware: Out-of-bounds Write

  CVE-2023-25281Mar 16, 2023D-LinkEPSS 1.07%

  A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp.

• 9.8 Critical severity

  D-Link DIR-820 Router OS Command Injection Exploited

  CVE-2023-25280Mar 16, 2023D-LinkEPSS 97.9%

  OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

• 7.5 High severity

  Dir-820l Firmware: Out-of-bounds Write

  CVE-2023-25283Mar 13, 2023D-LinkEPSS 1.18%

  A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp.

• 9.8 Critical severity

  D-Link DIR-820L Remote Code Execution Exploited

  CVE-2022-26258Mar 28, 2022D-LinkEPSS 91.6%

  D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

• 9.8 Critical severity

  D-Link Multiple Routers Remote Code Execution Exploited

  CVE-2021-45382Feb 17, 2022D-LinkEPSS 97.8%

  A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hard

• 9.8 Critical severity

  D-Link and TRENDnet Multiple Devices Remote Code Execution Exploited

  CVE-2015-1187Sep 21, 2017D-LinkEPSS 82.7%

  The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.