Dir-868l Firmware vulnerabilities

5 known vulnerabilities in Dir-868l Firmware from D-Link. 5 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  DIR-868L: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-3485Mar 3, 2026D-LinkEPSS 5.31%

  A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published

• 7.3 High severity

  Dir-868l Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-63932Nov 19, 2025D-LinkEPSS 8.08%

  D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the

• 9.8 Critical severity

  Dir-868l Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-55583Aug 28, 2025D-LinkEPSS 6.97%

  D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shel

• 9.8 Critical severity

  D-Link DIR-859 Router Command Execution Exploited

  CVE-2019-17621Dec 30, 2019D-LinkEPSS 90.6%

  The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting t

• 9.8 Critical severity

  D-Link Multiple Routers OS Command Injection Exploited

  CVE-2018-6530Mar 6, 2018D-LinkEPSS 96.7%

  OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous