D-Link
Vulnerability activity for D-Link: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 2
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 7.2HighApr 24, 2026D-Link DIR-823X Code / command injectionCVE-2025-29635D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV Apr 24, 2026Exploited88% likelyExploit codeNucleiDetection
- 9.8CriticalDec 8, 2025D-Link Routers Memory corruptionCVE-2022-37055D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV Dec 8, 2025Exploited56% likelyDetection
- 8.8HighNov 29, 2022D-Link DNR-322LCVE-2022-40799D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV Aug 5, 2025 · 980 days after publicationExploited34% likely
- 8.8HighSep 2, 2020D-Link DCS-2530L and DCS-2670L Devices Code / command injectionCVE-2020-25079D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV Aug 5, 2025 · 1,797 days after publicationExploited54% likely
- 7.5HighSep 2, 2020D-Link DCS-2530L and DCS-2670L DevicesCVE-2020-25078D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV Aug 5, 2025 · 1,797 days after publicationExploited98% likelyExploit codeNucleiDetection
- 5.3MediumJan 21, 2024D-Link DIR-859 Router Path traversal / file handlingCVE-2024-0769D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.Added to KEV Jun 25, 2025 · 521 days after publicationExploited83% likelyDetection
- 9.8CriticalMar 16, 2023D-Link DIR-820 Router Code / command injectionCVE-2023-25280D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.Added to KEV Sep 30, 2024 · 564 days after publicationExploited98% likelyExploit codeNucleiDetection
- 8.0HighJan 13, 2015D-Link DIR-600 Router CSRFCVE-2014-100005D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.Added to KEV May 16, 2024 · 3,411 days after publicationExploited43% likelyExploit codeMetasploitDetection
- 7.5HighSep 24, 2021D-Link DIR-605 Router Auth bypass / access controlCVE-2021-40655D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Added to KEV May 16, 2024 · 964 days after publicationExploited87% likelyExploit codeNucleiDetection
- 9.8CriticalApr 4, 2024D-Link Multiple NAS Devices Auth bypass / access controlCVE-2024-3272D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.Added to KEV Apr 11, 2024 · 7 days after publicationExploited98% likelyExploit codeNucleiDetection
- 7.3HighApr 4, 2024D-Link Multiple NAS Devices Code / command injectionCVE-2024-3273D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.Added to KEV Apr 11, 2024 · 7 days after publicationExploited100% likelyExploit codeNucleiDetection
- 9.8CriticalOct 19, 2022D-Link DSL-2750B Devices Code / command injectionCVE-2016-20017D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.Added to KEV Jan 8, 2024 · 446 days after publicationExploited66% likelyExploit codeMetasploitDetection
- 7.8HighMar 5, 2020D-Link DWL-2600AP Access Point Code / command injectionCVE-2019-20500D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.Added to KEV Jun 29, 2023 · 1,210 days after publicationExploited97% likelyExploit codeExploit-DBDetection
- 9.8CriticalDec 30, 2019D-Link DIR-859 Router Code / command injectionCVE-2019-17621D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.Added to KEV Jun 29, 2023 · 1,276 days after publicationExploited91% likelyExploit codeMetasploitDetection
- 5.7MediumDec 20, 2011D-Link DIR-300 Router Crypto / certificateCVE-2011-4723The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.Added to KEV Sep 8, 2022 · 3,915 days after publicationExploited3.1% likely
- 9.8CriticalMar 6, 2018D-Link Multiple Routers Code / command injectionCVE-2018-6530Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.Added to KEV Sep 8, 2022 · 1,646 days after publicationExploited97% likelyExploit codeNucleiDetection
- 9.8CriticalMar 27, 2022D-Link DIR-820L Code / command injectionCVE-2022-26258D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.Added to KEV Sep 8, 2022 · 165 days after publicationExploited92% likely
- 9.8CriticalSep 16, 2019D-Link DNS-320 Storage Device Code / command injectionCVE-2019-16057The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.Added to KEV Apr 15, 2022 · 942 days after publicationExploited86% likelyExploit codeNucleiDetection
- 9.8CriticalFeb 17, 2022D-Link Multiple Routers Code / command injectionCVE-2021-45382A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.Added to KEV Apr 4, 2022 · 45 days after publicationExploited98% likelyExploit codeNucleiDetection
- 5.4MediumNov 15, 2013D-Link DSL-2760U XSSCVE-2013-5223A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.Added to KEV Mar 25, 2022 · 3,051 days after publicationExploited51% likelyExploit codeExploit-DB
- 7.2HighMar 9, 2020D-Link DCS-930L Devices Code / command injectionCVE-2016-11021setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.Added to KEV Mar 25, 2022 · 746 days after publicationExploited70% likelyExploit codeMetasploit
- 9.8CriticalSep 27, 2019D-Link Multiple Routers Code / command injectionCVE-2019-16920Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.Added to KEV Mar 25, 2022 · 910 days after publicationExploited100% likelyExploit codeNucleiDetection
- 8.8HighJul 9, 2020D-Link DIR-610 Devices Code / command injectionCVE-2020-9377D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.Added to KEV Mar 25, 2022 · 623 days after publicationExploited22% likelyExploit code
- 8.8HighFeb 23, 2015D-Link DIR-645 Router Code / command injectionCVE-2015-2051D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.Added to KEV Feb 10, 2022 · 2,543 days after publicationExploited97% likelyExploit codeExploit-DB · MetasploitDetection
- 9.8CriticalFeb 2, 2021D-Link DNS-320 Device Code / command injectionCVE-2020-25506D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.Added to KEV Nov 3, 2021 · 273 days after publicationExploited100% likelyExploit codeNucleiDetection
Recent
- 9.8CriticalOct 28, 2026D-Link DIR-505CVE-2026-118579A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
- 8.8HighOct 23, 2026D-Link Code / command injectionCVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
- 9.8CriticalOct 21, 2026D-Link DHP-W610AVCVE-2026-113736A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- 7.2HighApr 24, 2026D-Link DIR-823X Code / command injectionCVE-2025-29635D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Exploited88% likelyExploit codeNucleiDetection
- 9.3CriticalJan 5, 2026D-Link DSL-2640B Auth bypass / access controlCVE-2026-0625Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was lever
- 9.8CriticalDec 8, 2025D-Link Routers Memory corruptionCVE-2022-37055D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Exploited56% likelyDetection
- 7.2HighOct 9, 2025D-Link Nuclias Connect Path traversal / file handlingCVE-2025-34248D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
- 7.5HighSep 2, 2020D-Link DCS-2530L and DCS-2670L DevicesCVE-2020-25078D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Exploited98% likelyExploit codeNucleiDetection
- 8.8HighSep 2, 2020D-Link DCS-2530L and DCS-2670L Devices Code / command injectionCVE-2020-25079D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Exploited54% likely
- 8.8HighNov 29, 2022D-Link DNR-322LCVE-2022-40799D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Exploited34% likely
- 5.3MediumJan 21, 2024D-Link DIR-859 Router Path traversal / file handlingCVE-2024-0769D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.Exploited83% likelyDetection
- 9.8CriticalMar 16, 2023D-Link DIR-820 Router Code / command injectionCVE-2023-25280D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.Exploited98% likelyExploit codeNucleiDetection
- 7.5HighSep 24, 2021D-Link DIR-605 Router Auth bypass / access controlCVE-2021-40655D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Exploited87% likelyExploit codeNucleiDetection
- 8.0HighJan 13, 2015D-Link DIR-600 Router CSRFCVE-2014-100005D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.Exploited43% likelyExploit codeMetasploitDetection
- 7.3HighApr 4, 2024D-Link Multiple NAS Devices Code / command injectionCVE-2024-3273D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.Exploited100% likelyExploit codeNucleiDetection
- 9.8CriticalApr 4, 2024D-Link Multiple NAS Devices Auth bypass / access controlCVE-2024-3272D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.Exploited98% likelyExploit codeNucleiDetection
- 9.8CriticalOct 19, 2022D-Link DSL-2750B Devices Code / command injectionCVE-2016-20017D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.Exploited66% likelyExploit codeMetasploitDetection
- 9.8CriticalDec 30, 2019D-Link DIR-859 Router Code / command injectionCVE-2019-17621D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.Exploited91% likelyExploit codeMetasploitDetection
- 7.8HighMar 5, 2020D-Link DWL-2600AP Access Point Code / command injectionCVE-2019-20500D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.Exploited97% likelyExploit codeExploit-DBDetection
- 9.8CriticalMar 27, 2022D-Link DIR-820L Code / command injectionCVE-2022-26258D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.Exploited92% likely
- 9.8CriticalMar 6, 2018D-Link Multiple Routers Code / command injectionCVE-2018-6530Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.Exploited97% likelyExploit codeNucleiDetection
- 5.7MediumDec 20, 2011D-Link DIR-300 Router Crypto / certificateCVE-2011-4723The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.Exploited3.1% likely
- 9.8CriticalSep 16, 2019D-Link DNS-320 Storage Device Code / command injectionCVE-2019-16057The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.Exploited86% likelyExploit codeNucleiDetection
- 9.8CriticalFeb 17, 2022D-Link Multiple Routers Code / command injectionCVE-2021-45382A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.Exploited98% likelyExploit codeNucleiDetection
- 8.8HighJul 9, 2020D-Link DIR-610 Devices Code / command injectionCVE-2020-9377D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.Exploited22% likelyExploit code
- 9.8CriticalSep 27, 2019D-Link Multiple Routers Code / command injectionCVE-2019-16920Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.Exploited100% likelyExploit codeNucleiDetection
- 7.2HighMar 9, 2020D-Link DCS-930L Devices Code / command injectionCVE-2016-11021setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.Exploited70% likelyExploit codeMetasploit
- 5.4MediumNov 15, 2013D-Link DSL-2760U XSSCVE-2013-5223A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.Exploited51% likelyExploit codeExploit-DB
- 8.8HighFeb 23, 2015D-Link DIR-645 Router Code / command injectionCVE-2015-2051D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.Exploited97% likelyExploit codeExploit-DB · MetasploitDetection
- 9.8CriticalJan 29, 2021D-Link DIR-825 R1 Devices Memory corruptionCVE-2020-29557D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.Exploited56% likelyDetection
- 9.8CriticalFeb 2, 2021D-Link DNS-320 Device Code / command injectionCVE-2020-25506D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.Exploited100% likelyExploit codeNucleiDetection
Top products
- Routers1 CVE in the last year, 1 critical, 1 exploited
- DSL-2640B1 CVE in the last year, 1 critical
- DIR-823X1 CVE in the last year, 1 exploited
- DIR-5051 CVE in the last year, 1 critical
- DHP-W610AV1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.