d-link vulnerabilities

Recent CVEs affecting d-link products. 110 tracked.

d-link has 110 tracked vulnerabilities, 32 critical. A fixed release or vendor patch exists for 25. Most recent: 2021-10-31. Highest priority: CVE-2021-26709 (score 69/100).

CVE-2021-33259 MEDIUM 5.3 MITIGATE Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for
CVE-2021-41503 HIGH 8.0 UPGRADE MITIGATE DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control
CVE-2021-26709 CRITICAL 9.8 UPGRADE D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unaut
CVE-2020-9544 HIGH 7.5 MITIGATE An issue was discovered on D-Link DSL-2640B E1 EU_1.01 devices
CVE-2020-15633 HIGH 8.8 UPGRADE UPGRADE This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-L
CVE-2019-9125 CRITICAL 9.8 MITIGATE An issue was discovered on D-Link DIR-878 1.12B01 devices
CVE-2019-9124 CRITICAL 9.8 MITIGATE An issue was discovered on D-Link DIR-878 1.12B01 devices
CVE-2019-7297 CRITICAL 9.8 UPGRADE An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03
CVE-2019-6258 CRITICAL 9.8 UPGRADE D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress d
CVE-2019-17663 MEDIUM 6.1 MITIGATE D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, lead
CVE-2018-8941 HIGH 8.8 MITIGATE Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v
CVE-2018-7698 HIGH 8.1 DOWNGRADE An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices
CVE-2018-6936 MEDIUM 5.4 MITIGATE Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
CVE-2018-6213 CRITICAL 9.8 MITIGATE In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.
CVE-2018-6212 MEDIUM 6.1 MITIGATE On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3,
CVE-2018-6211 HIGH 7.2 MITIGATE On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3,
CVE-2018-5371 HIGH 8.8 MITIGATE MITIGATE diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmwa
CVE-2018-20389 CRITICAL 9.8 MITIGATE MITIGATE D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to d
CVE-2018-20305 CRITICAL 9.8 MITIGATE D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpas
CVE-2018-20057 HIGH 8.8 MITIGATE MITIGATE An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices
CVE-2018-20056 CRITICAL 9.8 MITIGATE MITIGATE An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices
CVE-2018-19990 CRITICAL 9.8 MITIGATE In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-
CVE-2018-19989 CRITICAL 9.8 MITIGATE MITIGATE In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link
CVE-2018-19988 CRITICAL 9.8 MITIGATE In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vuln
CVE-2018-19987 CRITICAL 9.8 MITIGATE MITIGATE D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880
CVE-2018-19986 CRITICAL 9.8 MITIGATE MITIGATE In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects
CVE-2018-19300 CRITICAL 9.8 UPGRADE UPGRADE On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-11
CVE-2018-18767 HIGH 7.0 DOWNGRADE MITIGATE An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06
CVE-2018-18636 MEDIUM 6.1 MITIGATE XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.
CVE-2018-18442 HIGH 7.5 MITIGATE D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (Do
CVE-2018-18441 HIGH 7.5 MITIGATE MITIGATE D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration
CVE-2018-17881 CRITICAL 9.8 MITIGATE On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands with
CVE-2018-17880 HIGH 7.5 MITIGATE On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without auth
CVE-2018-17787 CRITICAL 9.8 MITIGATE On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters
CVE-2018-17786 CRITICAL 9.8 MITIGATE On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.
CVE-2018-16408 HIGH 7.2 MITIGATE D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a Set
CVE-2018-14081 CRITICAL 9.8 UPGRADE UPGRADE An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 device
CVE-2018-14080 HIGH 7.5 UPGRADE UPGRADE An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 device
CVE-2018-12103 MEDIUM 6.5 UPGRADE UPGRADE An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1
CVE-2018-11013 CRITICAL 9.8 MITIGATE Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with fir
CVE-2018-10996 CRITICAL 9.8 MITIGATE The weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to execute arbitrary
CVE-2018-10968 CRITICAL 9.8 UPGRADE UPGRADE On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to
CVE-2018-10967 HIGH 8.8 UPGRADE UPGRADE On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject
CVE-2018-10750 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10749 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10748 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10747 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10746 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10713 HIGH 8.8 MITIGATE An issue was discovered on D-Link DSL-3782 EU 1.01 devices
CVE-2018-10431 HIGH 7.2 MITIGATE D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the Sy
CVE-2018-10110 MEDIUM 4.8 MITIGATE D-Link DIR-615 T1 devices allow XSS via the Add User feature.
CVE-2017-9542 CRITICAL 9.8 MITIGATE D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi
CVE-2017-7851 HIGH 8.8 UPGRADE D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that require
CVE-2017-7398 HIGH 8.8 MITIGATE D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability
CVE-2017-5874 HIGH 8.8 UPGRADE CSRF exists on D-Link DIR-600M Rev
CVE-2017-5633 HIGH 8.0 MITIGATE Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware
CVE-2017-3192 CRITICAL 9.8 MITIGATE MITIGATE D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrat
CVE-2017-3191 CRITICAL 9.8 MITIGATE MITIGATE D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass
CVE-2017-10676 MEDIUM 6.1 MITIGATE On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi userna
CVE-2016-5681 CRITICAL 9.8 UPGRADE MITIGATE Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818L
CVE-2016-1559 HIGH 8.1 MITIGATE MITIGATE D-Link DAP-1353 H/W vers
CVE-2016-10405 CRITICAL 9.8 UPGRADE Session fixation vulnerability in D-Link DIR-600L routers (rev
CVE-2015-7247 CRITICAL 9.8 MITIGATE D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, v
CVE-2015-7246 CRITICAL 9.8 MITIGATE D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the
CVE-2015-7245 HIGH 7.5 MITIGATE Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 al
CVE-2014-9518 MEDIUM 4.3 UPGRADE MITIGATE Cross-site scripting (XSS) vulnerability in login.cgi in D-Link router DIR-655 (rev Bx) with firmware before 2
CVE-2014-9238 MEDIUM 5.0 MITIGATE D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to obtain the installation path via the
CVE-2014-9234 MEDIUM 5.0 MITIGATE Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 a
CVE-2014-7860 MEDIUM 5.3 UPGRADE UPGRADE The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119
CVE-2014-7859 CRITICAL 9.8 UPGRADE UPGRADE Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322
CVE-2014-7858 CRITICAL 9.8 UPGRADE The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authenticati
CVE-2014-7857 CRITICAL 9.8 UPGRADE UPGRADE D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01,
CVE-2013-7321 MEDIUM 4.3 UPGRADE MITIGATE Cross-site scripting (XSS) vulnerability in D-Link DAP-2253 Access Point (Rev
CVE-2013-7320 MEDIUM 6.8 UPGRADE MITIGATE Cross-site request forgery (CSRF) vulnerability in D-Link DAP-2253 Access Point (Rev
CVE-2013-6811 HIGH 8.8 MITIGATE Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev
CVE-2010-2293 MEDIUM 6.8 MITIGATE The Ping tools web interface in Dlink Di-604 router allows remote authenticated users to cause a denial of ser
CVE-2010-2292 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in the Ping tools web interface in Dlink Di-604 router allows remote
CVE-2010-0936 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in auth.asp on the D-LINK DKVM-IP8 with firmware 2282_dlinkA4_p8_2007
CVE-2009-3347 HIGH 10.0 MITIGATE Buffer overflow on the D-Link DIR-400 wireless router allows remote attackers to execute arbitrary code via un
CVE-2008-4771 HIGH 9.3 DOWNGRADE DOWNGRADE Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll
CVE-2008-4133 MEDIUM 4.3 MITIGATE The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web reques
CVE-2008-1258 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to in
CVE-2008-1253 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attacke
CVE-2007-3348 HIGH 7.8 MITIGATE MITIGATE The D-Link DPH-540/DPH-541 phone allows remote attackers to cause a denial of service (device outage) via a ma
CVE-2007-3347 HIGH 7.8 MITIGATE MITIGATE The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, w
CVE-2007-1435 HIGH 10.0 DOWNGRADE Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a l
CVE-2006-6538 HIGH 7.8 MITIGATE D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a
CVE-2006-6055 HIGH 10.0 MITIGATE Stack-based buffer overflow in A5AGU.SYS 1.0.1.41 for the D-Link DWL-G132 wireless adapter allows remote attac
CVE-2006-5538 MEDIUM 5.0 MITIGATE D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to list contents of the cgi-bin dir
CVE-2006-5537 MEDIUM 4.3 MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.Y
CVE-2006-5536 MEDIUM 5.0 MITIGATE Directory traversal vulnerability in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allow
CVE-2006-3687 HIGH 7.5 MITIGATE MITIGATE Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband R
CVE-2006-2901 MEDIUM 5.0 UPGRADE The web server for D-Link Wireless Access-Point (DWL-2100ap) firmware 2.10na and earlier allows remote attacke
CVE-2006-2653 LOW 2.6 MITIGATE Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to i
CVE-2006-2337 MEDIUM 5.0 MITIGATE Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote at
CVE-2006-0784 MEDIUM 5.0 MITIGATE D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP
CVE-2005-4723 MEDIUM 5.0 MITIGATE MITIGATE D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 allow remote attackers to cause a denial of
CVE-2005-1680 HIGH 7.5 MITIGATE MITIGATE D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when /cgi-bin/firmwarecfg is executed, allows remote attac
CVE-2004-1650 HIGH 7.5 MITIGATE D-Link DCS-900 Internet Camera listens on UDP port 62976 for an IP address, which allows remote attackers to c
CVE-2004-0661 MEDIUM 5.0 MITIGATE MITIGATE Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers t
CVE-2004-0615 MEDIUM 5.1 MITIGATE MITIGATE Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO
CVE-2003-1346 HIGH 10.0 MITIGATE D-Link wireless access point DWL-900AP+ 2.2, 2.3 and possibly 2.5 allows remote attackers to set factory defau
CVE-2003-1264 MEDIUM 5.0 MITIGATE MITIGATE TFTP server in Longshine Wireless Access Point (WAP) LCS-883R-AC-B, and in D-Link DI-614+ 2.0 which is based o
CVE-2002-2137 MEDIUM 5.0 MITIGATE MITIGATE GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL
CVE-2002-1865 MEDIUM 5.0 MITIGATE MITIGATE Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.
CVE-2002-1069 MEDIUM 5.0 MITIGATE The remote administration capability for the D-Link DI-804 router 4.68 allows remote attackers to bypass authe
CVE-2002-1068 MEDIUM 5.0 MITIGATE The web server for D-Link DP-300 print server allows remote attackers to cause a denial of service (hang) via
CVE-2001-1221 MEDIUM 5.0 MITIGATE D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'publ
CVE-2001-1220 HIGH 10.0 MITIGATE D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plainte
CVE-2001-1137 MEDIUM 5.0 MITIGATE D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of serv

FAQ

How do I fix d-link vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is d-link being exploited right now?

None of the tracked d-link CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which d-link CVE should I patch first?

CVE-2021-26709 currently ranks highest (69/100): D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unaut.

Products

RSS feed for d-link · ← Back to latest CVEs