Dir-882 Firmware vulnerabilities

18 known vulnerabilities in Dir-882 Firmware from D-Link. 18 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

18vulnerabilities

3critical

15high

0exploited

8.2average CVSS score

Latest first

7.2 High severity
DIR-882: Improper Neutralization of Special Elements used in a Command
CVE-2026-5844Apr 9, 2026D-LinkEPSS 5.16%
A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. The manipulation of the argument IPAddress results in os command injection. The attack may be performe
7.3 High severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2025-60698Nov 13, 2025D-LinkEPSS 3.93%
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_432F60` function in `prog.cgi` stores user-supplied `SetSysLogSettings/IPAddress` values in NVRAM via `nvram_safe
7.3 High severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2025-60697Nov 13, 2025D-LinkEPSS 3.82%
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. The `sub_4438A4` function in `prog.cgi` stores user-supplied DDNS parameters (`ServerAddress` and `Hostname`) in NVRAM via
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48638Oct 17, 2024D-LinkEPSS 2.15%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48637Oct 17, 2024D-LinkEPSS 2.15%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48636Oct 17, 2024D-LinkEPSS 2.15%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48635Oct 17, 2024D-LinkEPSS 2.15%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48634Oct 17, 2024D-LinkEPSS 17.6%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POS
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48633Oct 17, 2024D-LinkEPSS 2.11%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerab
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48632Oct 17, 2024D-LinkEPSS 2.11%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48631Oct 17, 2024D-LinkEPSS 2.14%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted PO
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48630Oct 17, 2024D-LinkEPSS 2.12%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted PO
8.0 High severity
dir-882_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-48629Oct 17, 2024D-LinkEPSS 2.15%
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a
8.8 High severity
dir_882_firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24330Feb 21, 2024D-LinkEPSS 1.28%
Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.
9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28901May 10, 2022D-LinkEPSS 3.52%
A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28896May 10, 2022D-LinkEPSS 3.52%
A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28895May 10, 2022D-LinkEPSS 3.52%
A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
7.8 High severity
D-Link Routers: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-1262Apr 11, 2022D-Link RoutersEPSS 2.21%
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.