D Link

Known Exploited D Link Vulnerabilities

The following D Link vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 12 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 6 known exploited D Link vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest D Link Vulnerabilities

Based on the current exploit probability, these D Link vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

By the Year

In 2026 there have been 3 vulnerabilities in D Link with an average score of 5.5 out of ten. Last year, in 2025 D Link had 8 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in D Link in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.77

Recent D Link Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-2210	Feb 09, 2026	Remote OS Command Injection via /goform/set_filtering on D-Link DIR-823X A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.	Dir 823x
CVE-2026-2082	Feb 07, 2026	OS Command Injection via /goform/set_mac_clone on D-Link DIR-823X A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.	Dir 823x
CVE-2026-2081	Feb 07, 2026	D-Link DIR-823X OS Command Injection via /goform/set_password A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.	Dir 823x
CVE-2018-25120	Oct 29, 2025	D-Link DNS-3431.05 cmd injection via Mail_Test D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life.	Dns 343 Sharecenter
CVE-2025-10441	Sep 15, 2025	D-Link DI-8100G/8200G/8003G 17.12/19.12 OS Cmd Injection via jhttpd A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVE-2025-10440	Sep 15, 2025	D-Link DI-8100 JHTTPD CLI Injection via usb_paswd.asp hname (v16/17/19) A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.	Di 8100 Di 8200 Di 8003 And others...
CVE-2025-10401	Sep 14, 2025	D-Link DIR-823x: CMD Injection via /goform/diag_ping target_addr A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Performing manipulation of the argument target_addr results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2018-25115	Aug 27, 2025	D-Link DIR routers v1.03 arbitrary cmd exec via service.cgi CVE-2018-25115 Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.	Dir 815
CVE-2013-10048	Aug 01, 2025	OS Command Injection in D-Link DIR-300 rev B/600 command.php (before 2.14b01) An OS command injection vulnerability exists in various legacy D-Link routersincluding DIR-300 rev B and DIR-600 (firmware 2.13 and 2.14b01, respectively)due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.	Dir 600 Dir 300
CVE-2013-10050	Aug 01, 2025	D-Link DIR-300/615 OS Command Injection via tools_vct.xgi An OS command injection vulnerability exists in multiple D-Link routersconfirmed on DIR-300 rev A (v1.05) and DIR-615 rev D (v4.13)via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is present in firmware versions that expose tools_vct.xgi and use the Mathopd/1.5p6 web server. No vendor patch is available, and affected models are end-of-life.	Dir 300 Dir 615
CVE-2025-34048	Jun 26, 2025	Pre-1.04 Path-Traversal in D-Link DSL-2730U/2750U/2750E with webproc A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.	Dsl 2750u Dcs 2750e
CVE-2024-45623	Sep 02, 2024	D-Link DAP-2310 ATP Binary Buffer Overflow 1.16RC028 D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handles PHP HTTP GET requests for the Apache HTTP Server (httpd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.	Dap 2310
CVE-2020-19319	Sep 11, 2023	Buffer Overflow in D-Link 619L B 2.06beta via FILECODE Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.	202l
CVE-2020-19320	Sep 11, 2023	Buffer Overflow in DLINK 619L 2.06beta curTime on Login Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.	Dir 619l
CVE-2020-19323	Sep 11, 2023	DIR-619L 2.06beta mini_upnpd Heap Buffer Overflow via M-search ST An issue was discovered in /bin/mini_upnpd on D-Link DIR-619L 2.06beta devices. There is a heap buffer overflow allowing remote attackers to restart router via the M-search request ST parameter. No authentication required	Dir 619l
CVE-2020-19318	Sep 11, 2023	D-Link DIR-605L Buffer Overflow in webserver (1.17beta and below) Buffer Overflow vulnerability in D-Link DIR-605L, hardware version AX, firmware version 1.17beta and below, allows authorized attackers execute arbitrary code via sending crafted data to the webserver service program.	Dir 605l
CVE-2022-44929	Dec 02, 2022	D-Link DVG-G5402SP GE_1.03 PrivEsc via VoIP SIB Profile Edit An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.	Dvg G5402sp Firmware
CVE-2022-44928	Dec 02, 2022	Command Injection in D-Link DVG-G5402SP GE_1.03 Maintenance Function D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.	Dvg G5402sp Firmware
CVE-2021-26709	Apr 07, 2021	D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer	Dsl 320b D1
CVE-2020-12695	Jun 08, 2020	The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.	Dvg N5412sp
CVE-2018-15517	Jan 31, 2019	The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.	Central Wifimanager
CVE-2018-15516	Jan 31, 2019	The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.	Central Wifimanager
CVE-2018-18767	Dec 20, 2018	An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06 An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.	Mydlink Baby Camera Monitor
CVE-2018-17443	Oct 08, 2018	An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1 An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.	Central Wifimanager
CVE-2018-17442	Oct 08, 2018	An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1 An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code.	Central Wifimanager
CVE-2018-17441	Oct 08, 2018	An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1 An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.	Central Wifimanager
CVE-2018-17440	Oct 08, 2018	An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1 An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.	Central Wifimanager
CVE-2018-7698	Mar 05, 2018	An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge.	Mydlink
CVE-2006-3687	Jul 21, 2006	Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long M-SEARCH request to UDP port 1900.	Wbr 1310 Wireless G Router Di 604 Broadband Router Di 784 And others...
CVE-2005-4723	Dec 31, 2005	D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 allow remote attackers to cause a denial of service (device reboot) via a series of crafted fragmented UDP packets, possibly involving a missing fragment.	Di 784 Di 524
CVE-2004-0615	Dec 06, 2004	Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624 Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request.	Di 704p Di 614