Dir-890l Firmware vulnerabilities

4 known vulnerabilities in Dir-890l Firmware from D-Link. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  DIR-890L: Improper Neutralization of Special Elements used in a Command

  CVE-2025-4340May 6, 2025D-LinkEPSS 5.25%

  A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remo

• 8.8 High severity

  dir-890l_firmware: Use of Hard-coded Credentials

  CVE-2022-29778Jun 3, 2022D-LinkEPSS 2.89%

  D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php

• 9.8 Critical severity

  Dir-890l Firmware: Out-of-bounds Write

  CVE-2022-30521Jun 2, 2022D-LinkEPSS 15.1%

  The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checki

• 9.8 Critical severity

  D-Link DIR-859 Router Command Execution Exploited

  CVE-2019-17621Dec 30, 2019D-LinkEPSS 90.6%

  The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting t