Routers, cameras and IoT: vulnerabilities and fixes

TP-Link, D-Link, Netgear, Hikvision, Dahua, NAS devices and wireless. 129 CVEs tracked.

Routers, cameras and IoT has 129 tracked vulnerabilities, 20 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 73. Most recent: 2026-10-23. Highest priority: CVE-2026-86060 (score 96/100).

• CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
• CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
• CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-19348 CRITICAL 9.8 A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a
• CVE-2026-71945 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71946 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71947 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71949 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71950 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71951 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71952 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71954 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71955 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command
• CVE-2026-71944 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71948 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71953 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c
• CVE-2026-71956 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command
• CVE-2026-53921 CRITICAL 9.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-69096 HIGH 8.8 OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC bac
• CVE-2026-71957 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer o
• CVE-2026-71958 CRITICAL 9.8 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer o
• CVE-2026-15428 HIGH 8.8 UPGRADE An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the
• CVE-2026-15429 HIGH 8.8 UPGRADE A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1
• CVE-2026-16327 HIGH 7.3 A vulnerability was determined in D-Link DNS-320 1.0.2
• CVE-2026-16329 HIGH 7.3 A vulnerability was identified in D-Link DNS-320 1.0.2
• CVE-2026-16330 HIGH 7.3 A weakness has been identified in D-Link DNS-320 1.0.2
• CVE-2026-16331 HIGH 7.3 A security vulnerability has been detected in D-Link DNS-320 1.0.2
• CVE-2026-16332 HIGH 7.3 A vulnerability was detected in D-Link DNS-320 1.0.2
• CVE-2026-16447 HIGH 7.3 A vulnerability has been found in D-Link DNS-320 1.0.2
• CVE-2026-53918 HIGH 8.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-64825 CRITICAL 9.3 Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attack
• CVE-2026-69095 HIGH 7.5 OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnera
• CVE-2026-9044 HIGH 8.0 UPGRADE An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers
• CVE-2026-15427 HIGH 8.1 UPGRADE An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 du
• CVE-2026-45813 HIGH 8.8 UPGRADE Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Impro
• CVE-2026-53920 HIGH 8.7 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-72581 HIGH 8.6 A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remot
• CVE-2026-15314 HIGH 7.5 UPGRADE Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authen
• CVE-2026-59260 HIGH 8.8 OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegat
• CVE-2026-64824 HIGH 8.4 Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function tha
• CVE-2025-34248 HIGH 7.2 D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web
• CVE-2026-45811 HIGH 7.5 UPGRADE Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI
• CVE-2026-53455 HIGH 8.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-53453 HIGH 8.7 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-113779 HIGH 8.8 The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plu
• CVE-2026-11739 MEDIUM 6.4 UPGRADE UPGRADE A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent att
• CVE-2026-74534 HIGH 8.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_co
• CVE-2026-79982 HIGH 8.8 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copi
• CVE-2026-19291 HIGH 8.8 Bluetooth re-pairing with an existing device can use a lower security level
• CVE-2026-55606 MEDIUM 6.5 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2023-7356 HIGH 8.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data
• CVE-2026-10685 HIGH 7.6 UPGRADE The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt
• CVE-2026-12989 HIGH 8.7 A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthen
• CVE-2026-22099 HIGH 8.7 The charging station does not require authentication for Bluetooth commands to perform actions
• CVE-2026-89035 HIGH 7.4 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that al
• CVE-2026-11368 HIGH 7.1 UPGRADE The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its ow
• CVE-2026-15680 HIGH 7.5 Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability
• CVE-2026-98889 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE siz
• CVE-2026-99012 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent conn
• CVE-2026-99013 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS lis
• CVE-2026-99014 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb life
• CVE-2026-53454 MEDIUM 6.9 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-79876 CRITICAL 9.3 A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauth
• CVE-2026-18536 HIGH 7.5 UPGRADE Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::
• CVE-2026-53457 MEDIUM 5.1 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-99011 HIGH 7.1 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifeti
• CVE-2026-65935 HIGH 7.6 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the tempo
• CVE-2026-98456 HIGH 7.0 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_
• CVE-2026-2411 MEDIUM 6.5 UPGRADE Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declara
• CVE-2026-57599 MEDIUM 6.6 There is a privilege escalation vulnerability in some Hikvision cameras
• CVE-2026-10680 HIGH 7.6 UPGRADE The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/
• CVE-2026-11733 MEDIUM 4.9 UPGRADE UPGRADE A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily inte
• CVE-2026-17986 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-20495 HIGH 7.8 MITIGATE MITIGATE In Bluetooth driver, there is a possible permission bypass due to a missing permission check
• CVE-2026-53458 MEDIUM 5.3 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-15683 HIGH 7.5 Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability
• CVE-2026-10664 MEDIUM 5.0 UPGRADE The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nr
• CVE-2026-15316 MEDIUM 6.5 UPGRADE An improper input validation vulnerability in the configuration service for processing encrypted credential da
• CVE-2026-15757 MEDIUM 6.3 A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi netwo
• CVE-2026-4793 HIGH 7.3 UPGRADE An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to
• CVE-2026-66060 HIGH 7.1 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-66061 HIGH 7.1 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-14227 MEDIUM 4.9 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insuffic
• CVE-2026-11893 MEDIUM 5.9 The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drive
• CVE-2026-11894 MEDIUM 5.9 The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, vi
• CVE-2026-12236 MEDIUM 6.5 The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an A
• CVE-2026-49131 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker
• CVE-2026-5040 MEDIUM 6.7 UPGRADE TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials
• CVE-2026-71273 MEDIUM 6.5 OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET
• CVE-2026-10675 MEDIUM 4.3 UPGRADE In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() resche
• CVE-2026-17906 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remo
• CVE-2026-59717 MEDIUM 4.3 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-11734 LOW 2.7 UPGRADE UPGRADE A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the a
• CVE-2026-49305 MEDIUM 6.2 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vuln
• CVE-2026-53456 MEDIUM 5.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-64823 MEDIUM 4.7 Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's
• CVE-2026-65933 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information
• CVE-2026-65936 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive i
• CVE-2026-67596 MEDIUM 6.2 CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unau
• CVE-2026-49132 MEDIUM 5.4 OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attacker
• CVE-2026-11738 MEDIUM 4.4 UPGRADE UPGRADE Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators c
• CVE-2026-15141 MEDIUM 5.7 UPGRADE The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Re
• CVE-2026-17737 MEDIUM 5.0 UPGRADE Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who h
• CVE-2026-20494 MEDIUM 5.5 MITIGATE MITIGATE In wifi, there is a possible out of bounds read due to a missing bounds check
• CVE-2026-30613 MEDIUM 4.6 An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled So
• CVE-2026-10774 LOW 2.4 UPGRADE Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown
• CVE-2026-11737 MEDIUM 4.5 UPGRADE UPGRADE Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators
• CVE-2026-62659 MEDIUM 4.3 A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in a
• CVE-2026-63243 MEDIUM 4.3 An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Kat
• CVE-2026-9214 MEDIUM 4.5 MITIGATE Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators c
• CVE-2026-20493 MEDIUM 4.4 MITIGATE MITIGATE In wifi, there is a possible out of bounds write due to a missing bounds check
• CVE-2026-78117 MEDIUM 4.2 The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing H
• CVE-2026-52356 HIGH n/a An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WW
• CVE-2026-18748 LOW 3.5 The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte
• CVE-2026-98887 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized H
• CVE-2026-98890 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX f
• CVE-2026-98891 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame len
• CVE-2026-98916 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing fo
• CVE-2026-98936 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on h
• CVE-2026-98957 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when
• CVE-2026-98958 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per pe
• CVE-2026-99008 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev deref
• CVE-2026-99009 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session so
• CVE-2026-99010 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the
• CVE-2026-99015 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-devic
• CVE-2026-99060 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global sta
• CVE-2026-99061 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal ra
• CVE-2026-98874 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN
• CVE-2026-78801 HIGH n/a An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remo

FAQ

How do I fix Routers, cameras and IoT vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Routers, cameras and IoT being exploited right now?

Yes: 3 Routers, cameras and IoT CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Routers, cameras and IoT CVE should I patch first?

CVE-2026-86060 currently ranks highest (96/100): MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability.

Software in this group

People search for: router, camera, nas, wifi, bluetooth, iot.

← Back to latest CVEs