https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-6213.htmlhttps://patchthecve.com/cve/CVE-2018-6213.htmlWed, 17 Jun 2026 02:01:31 +0000CRITICAL 9.8: In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account.https://patchthecve.com/cve/CVE-2018-6212.htmlhttps://patchthecve.com/cve/CVE-2018-6212.htmlWed, 17 Jun 2026 02:01:31 +0000MEDIUM 6.1: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting (XSS) attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of https://patchthecve.com/cve/CVE-2018-6211.htmlhttps://patchthecve.com/cve/CVE-2018-6211.htmlWed, 17 Jun 2026 02:01:31 +0000HIGH 7.2: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, OS command injection is possible as a result of incorrect processing of the res_buf parameter to index.cgi.https://patchthecve.com/cve/CVE-2018-6210.htmlhttps://patchthecve.com/cve/CVE-2018-6210.htmlWed, 17 Jun 2026 02:01:31 +0000CRITICAL 9.8: D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for remote attackers to obtain access via a TELNET session.