Dir-878 Firmware vulnerabilities

20 known vulnerabilities in Dir-878 Firmware from D-Link. 20 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  DIR-878: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-0481Jan 15, 2025D-LinkEPSS 1.43%

  A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP POST Request Handler. The manipulation leads to information disclosure. It is possible to launch the a

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48638Oct 17, 2024D-LinkEPSS 2.15%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48637Oct 17, 2024D-LinkEPSS 2.15%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48636Oct 17, 2024D-LinkEPSS 2.15%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48635Oct 17, 2024D-LinkEPSS 2.15%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48634Oct 17, 2024D-LinkEPSS 17.6%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POS

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48633Oct 17, 2024D-LinkEPSS 2.11%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerab

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48632Oct 17, 2024D-LinkEPSS 2.11%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48631Oct 17, 2024D-LinkEPSS 2.14%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted PO

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48630Oct 17, 2024D-LinkEPSS 2.12%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted PO

• 8.0 High severity

  dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48629Oct 17, 2024D-LinkEPSS 2.15%

  D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a

• 9.8 Critical severity

  Dir-878 Firmware: Out-of-bounds Write

  CVE-2023-27720Apr 9, 2023D-LinkEPSS 1.35%

  D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.

• 9.8 Critical severity

  Dir-878 Firmware: Out-of-bounds Write

  CVE-2023-24800Apr 7, 2023D-LinkEPSS 1.3%

  D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.

• 9.8 Critical severity

  Dir-878 Firmware: Out-of-bounds Write

  CVE-2023-24799Apr 7, 2023D-LinkEPSS 1.11%

  D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.

• 9.8 Critical severity

  Dir-878 Firmware: Out-of-bounds Write

  CVE-2023-24798Apr 7, 2023D-LinkEPSS 1.11%

  D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.

• 9.8 Critical severity

  Dir 878 Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-48108Jan 27, 2023D-LinkEPSS 3.15%

  D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.

• 9.8 Critical severity

  Dir 878 Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-48107Jan 27, 2023D-LinkEPSS 3.15%

  D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.

• 8.8 High severity

  Multiple Routers: Out-of-bounds Write

  CVE-2022-41140Jan 26, 2023D-LinkEPSS 1.13%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which liste

• 7.8 High severity

  D-Link Routers: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-1262Apr 11, 2022D-Link RoutersEPSS 2.21%

  A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.

• 8.8 High severity

  DIR-878: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26670Apr 7, 2022D-LinkEPSS 1.55%

  D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.