https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-6580.htmlhttps://patchthecve.com/cve/CVE-2023-6580.htmlWed, 17 Jun 2026 06:51:01 +0000HIGH 8.8: A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_express_devices/smartqos_normal_devices leads to deserialization. It is possible thttps://patchthecve.com/cve/CVE-2023-43284.htmlhttps://patchthecve.com/cve/CVE-2023-43284.htmlWed, 17 Jun 2026 06:25:22 +0000HIGH 8.8: D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.https://patchthecve.com/cve/CVE-2022-46552.htmlhttps://patchthecve.com/cve/CVE-2022-46552.htmlWed, 17 Jun 2026 05:11:57 +0000HIGH 8.8: D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.https://patchthecve.com/cve/CVE-2022-46642.htmlhttps://patchthecve.com/cve/CVE-2022-46642.htmlWed, 17 Jun 2026 05:12:06 +0000CRITICAL 9.9: D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.https://patchthecve.com/cve/CVE-2022-46641.htmlhttps://patchthecve.com/cve/CVE-2022-46641.htmlWed, 17 Jun 2026 05:12:06 +0000CRITICAL 9.9: D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.https://patchthecve.com/cve/CVE-2020-21016.htmlhttps://patchthecve.com/cve/CVE-2020-21016.htmlWed, 17 Jun 2026 03:03:30 +0000CRITICAL 9.8: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.https://patchthecve.com/cve/CVE-2021-46319.htmlhttps://patchthecve.com/cve/CVE-2021-46319.htmlWed, 17 Jun 2026 04:14:43 +0000CRITICAL 9.8: Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.Thhttps://patchthecve.com/cve/CVE-2021-46315.htmlhttps://patchthecve.com/cve/CVE-2021-46315.htmlWed, 17 Jun 2026 04:14:43 +0000CRITICAL 9.8: Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parametershttps://patchthecve.com/cve/CVE-2021-46314.htmlhttps://patchthecve.com/cve/CVE-2021-46314.htmlWed, 17 Jun 2026 04:14:43 +0000CRITICAL 9.8: A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name.https://patchthecve.com/cve/CVE-2020-27600.htmlhttps://patchthecve.com/cve/CVE-2020-27600.htmlWed, 17 Jun 2026 03:09:19 +0000CRITICAL 9.8: HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.https://patchthecve.com/cve/CVE-2019-17510.htmlhttps://patchthecve.com/cve/CVE-2019-17510.htmlWed, 17 Jun 2026 02:24:02 +0000CRITICAL 9.8: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.https://patchthecve.com/cve/CVE-2019-17509.htmlhttps://patchthecve.com/cve/CVE-2019-17509.htmlWed, 17 Jun 2026 02:24:01 +0000CRITICAL 9.8: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php.https://patchthecve.com/cve/CVE-2018-16408.htmlhttps://patchthecve.com/cve/CVE-2018-16408.htmlWed, 17 Jun 2026 01:44:14 +0000HIGH 7.2: D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging admin access.