D-Link vulnerabilities
We track 922 vulnerabilities in D-Link products across 60+ products. 920 are rated high or critical, and 28 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest D-Link vulnerabilities
- 8.8 High severity
DIR-513: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-513 up to 20190831. It has been declared as critical. This vulnerability affects the function formSetWanDhcpplus of the file /goform/formSetWanDhcpplus. The manipulation of the argument curTime leads to buffer overflow.
- 8.8 High severity
DIR‑817L: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has b
- 9.8 Critical severity
DI-8100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the component jhttpd. The manipulation of the argument remove_ext_proto/remove_ext_port leads to stack-based b
- 8.8 High severity
DIR-513: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow
- 8.8 High severity
DIR-513: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. Affected by this issue is the function sprintf of the file /goform/formLanSetupRouterSettings of the component Boa Webserver. The manipulation of the argument curTime leads to stac
- 8.8 High severity
DI-8100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp?opt=add of the component jhttpd. The manipulation of the argument mx leads to stack-based buffer ove
- 8.8 High severity
DIR-816L: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in D-Link DIR-816L up to 2.06B01 and classified as critical. Affected by this vulnerability is the function lxmldbc_system of the file /htdocs/cgibin of the component Environment Variable Handler. The manipulation leads to comman
- 9.3 Critical severity
DSP-W110A1: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to exec
- 7.2 High severity
DI-8100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. Affected is an unknown function of the file /jingx.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to l
- 7.2 High severity
DI-8100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may
- 7.2 High severity
DIR-818LW: Improper Neutralization of Special Elements used in an OS Command
A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server leads to os command injection. It is possible to initiate the
- 9.8 Critical severity
DIR-825: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switch_language.cgi of the component httpd. The manipulation of the argument Language leads to stack-based buffer o
- 8.8 High severity
DI-500WF: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DI-500WF 17.04.10A1T. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file ip_position.asp of the component jhttpd. The manipulation of the argument ip leads to stack-based buf
- 8.8 High severity
DIR-645: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated rem
- 7.4 High severity
DCS-6517: Use of Insufficiently Random Values
A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation l
- 9.8 Critical severity
Dir-816 Firmware: Improper Neutralization of Special Elements used in a Command
An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file
- 8.8 High severity
DI-7300G+: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file msp_info.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is pos
- 8.8 High severity
DI-7300G+: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_s
- 9.8 Critical severity
DI-7300G+: Improper Neutralization of Special Elements used in an OS Command
A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been d
- 8.8 High severity
DI-7300G+: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. T
- 8.8 High severity
DIR-513: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The
- 8.8 High severity
DI-8100: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow.
- 8.7 High severity
DSL-2730U: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage pa
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack ma
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /goform/formSetWAN_Wizard51. The manipulation of the argument curTime leads to stack-based buffer over
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overf
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-base
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack ma
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. Th
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formSetWizard1 of the file /goform/formSetWizard1. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buff
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSetup of the file /goform/formWlanGuestSetup. The manipulation of the argument curTime leads to stack-based buffer overflow
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime/config.save_network_enabled leads to stack-based buffer
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-619L 2.06B01. It has been rated as critical. This issue affects the function formSetEmail of the file /goform/formSetEmail. The manipulation of the argument curTime/config.smtp_email_subject leads to stack-based buffer o
- 8.8 High severity
DIR-619L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-619L 2.06B01. It has been declared as critical. This vulnerability affects unknown code of the file /goform/formSetDomainFilter. The manipulation of the argument curTime/sched_name_%d/url_%d leads to stack-based buffer o
- 8.8 High severity
DIR-867: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely.
- 8.8 High severity
DIR-815: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-815 1.01. It has been declared as critical. This vulnerability affects the function sub_403794 of the file hedwig.cgi. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The expl
- 8.8 High severity
DIR-825: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated
- 8.8 High severity
DIR-825: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remo
- 9.8 Critical severity
Dph-400se Firmware: Use of Hard-coded Credentials
D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools