D-Link vulnerabilities
We track 922 vulnerabilities in D-Link products across 60+ products. 920 are rated high or critical, and 28 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest D-Link vulnerabilities
- 9.8 Critical severity
D-Link Routers Buffer Overflow Exploited
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
- 7.5 High severity
Dsl-3782 Firmware: Buffer Copy without Checking Size of Input
D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the User parameter or Pwd parameter to Login.asp.
- 9.8 Critical severity
Dir-816 Firmware: Improper Validation of Specified Quantity in Input
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and the result will be stored in v94, which does not check the size of l2tp_usrname, resulting in stack ove
- 7.5 High severity
Dir-816 Firmware: Improper Resource Shutdown or Release
D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the function returns at the end.
- 8.8 High severity
dir-890l_firmware: Use of Hard-coded Credentials
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
- 9.8 Critical severity
Dir-890l Firmware: Out-of-bounds Write
The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checki
- 9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
- 9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
- 9.8 Critical severity
Dir-882 Firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
- 9.8 Critical severity
Dir-823 Pro Firmware: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting. This vulnerability allows attackers to execute arbitrary commands via the system_time_timezone parameter.
- 7.8 High severity
D-Link Routers: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange. This vulnerability allows attackers to cause a Denial of Service (DoS) via the nextPage parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the config.save_network_enabled parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- 7.5 High severity
Dir-619 Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- 7.5 High severity
Dir-619 Ax Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- 7.5 High severity
Dir-619 Ax Firmware: Out-of-bounds Write
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- 8.8 High severity
DIR-878: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.
- 9.8 Critical severity
D-Link DIR-820L Remote Code Execution Exploited
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
- 9.8 Critical severity
D-Link Multiple Routers Remote Code Execution Exploited
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hard
- 7.5 High severity
D-Link DIR-605 Router Information Disclosure Exploited
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
- 9.8 Critical severity
D-Link DNS-320 Device Command Injection Exploited
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
- 9.8 Critical severity
D-Link DIR-825 R1 Devices Buffer Overflow Exploited
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.
- 8.8 High severity
D-Link DCS-2530L and DCS-2670L Command Injection Exploited
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
- 7.5 High severity
D-Link DCS-2530L and DCS-2670L Devices Unspecified Exploited
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
- 8.8 High severity
D-Link DIR-610 Devices Remote Command Execution Exploited
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- 7.2 High severity
D-Link DCS-930L Devices OS Command Injection Exploited
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
- 7.8 High severity
D-Link DWL-2600AP Access Point Command Injection Exploited
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip par
- 9.8 Critical severity
D-Link DIR-859 Router Command Execution Exploited
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting t
- 9.8 Critical severity
D-Link Multiple Routers Command Injection Exploited
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection.
- 9.8 Critical severity
D-Link DNS-320 Remote Code Execution Exploited
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
- 9.8 Critical severity
D-Link Multiple Routers OS Command Injection Exploited
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous
- 9.8 Critical severity
D-Link and TRENDnet Multiple Devices Remote Code Execution Exploited
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
- 9.8 Critical severity
Realtek SDK Improper Input Validation Exploited
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
- 8.8 High severity
D-Link DIR-645 Router Remote Code Execution Exploited
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
- 8.0 High severity
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Exploited
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable