PatchTheCVE: d-linkhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-33259: Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for https://patchthecve.com/cve/CVE-2021-33259.htmlhttps://patchthecve.com/cve/CVE-2021-33259.htmlThu, 09 Jul 2026 01:16:54 +0000MEDIUM 5.3: Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history.CVE-2021-41503: DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Controlhttps://patchthecve.com/cve/CVE-2021-41503.htmlhttps://patchthecve.com/cve/CVE-2021-41503.htmlWed, 17 Jun 2026 04:08:34 +0000HIGH 8.0: DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerCVE-2021-26709: D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthttps://patchthecve.com/cve/CVE-2021-26709.htmlhttps://patchthecve.com/cve/CVE-2021-26709.htmlWed, 17 Jun 2026 03:43:41 +0000CRITICAL 9.8: D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainerCVE-2019-6258: D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress dhttps://patchthecve.com/cve/CVE-2019-6258.htmlhttps://patchthecve.com/cve/CVE-2019-6258.htmlWed, 17 Jun 2026 02:38:53 +0000CRITICAL 9.8: D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message, which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file.CVE-2020-15633: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Lhttps://patchthecve.com/cve/CVE-2020-15633.htmlhttps://patchthecve.com/cve/CVE-2020-15633.htmlWed, 17 Jun 2026 02:56:57 +0000HIGH 8.8: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requeCVE-2020-9544: An issue was discovered on D-Link DSL-2640B E1 EU_1.01 deviceshttps://patchthecve.com/cve/CVE-2020-9544.htmlhttps://patchthecve.com/cve/CVE-2020-9544.htmlWed, 17 Jun 2026 03:28:07 +0000HIGH 7.5: An issue was discovered on D-Link DSL-2640B E1 EU_1.01 devices. The administrative interface doesn't perform authentication checks for a firmware-update POST request. Any attacker that can access the administrative interface can install firmware of their choice.CVE-2013-6811: Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Revhttps://patchthecve.com/cve/CVE-2013-6811.htmlhttps://patchthecve.com/cve/CVE-2013-6811.htmlWed, 17 Jun 2026 00:00:58 +0000HIGH 8.8: Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port ForwardingCVE-2019-17663: D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leadhttps://patchthecve.com/cve/CVE-2019-17663.htmlhttps://patchthecve.com/cve/CVE-2019-17663.htmlWed, 17 Jun 2026 02:24:22 +0000MEDIUM 6.1: D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection.CVE-2018-19990: In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-https://patchthecve.com/cve/CVE-2018-19990.htmlhttps://patchthecve.com/cve/CVE-2018-19990.htmlWed, 17 Jun 2026 01:50:14 +0000CRITICAL 9.8: In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pin" CVE-2018-19989: In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Linkhttps://patchthecve.com/cve/CVE-2018-19989.htmlhttps://patchthecve.com/cve/CVE-2018-19989.htmlWed, 17 Jun 2026 01:50:14 +0000CRITICAL 9.8: In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth interCVE-2018-19988: In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnhttps://patchthecve.com/cve/CVE-2018-19988.htmlhttps://patchthecve.com/cve/CVE-2018-19988.htmlWed, 17 Jun 2026 01:50:14 +0000CRITICAL 9.8: In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without anyCVE-2018-19987: D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880https://patchthecve.com/cve/CVE-2018-19987.htmlhttps://patchthecve.com/cve/CVE-2018-19987.htmlWed, 17 Jun 2026 01:50:14 +0000CRITICAL 9.8: D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint paramCVE-2018-19986: In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affectshttps://patchthecve.com/cve/CVE-2018-19986.htmlhttps://patchthecve.com/cve/CVE-2018-19986.htmlWed, 17 Jun 2026 01:50:14 +0000CRITICAL 9.8: In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuratCVE-2018-19300: On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-11https://patchthecve.com/cve/CVE-2018-19300.htmlhttps://patchthecve.com/cve/CVE-2018-19300.htmlWed, 17 Jun 2026 01:49:05 +0000CRITICAL 9.8: On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) bCVE-2019-9125: An issue was discovered on D-Link DIR-878 1.12B01 deviceshttps://patchthecve.com/cve/CVE-2019-9125.htmlhttps://patchthecve.com/cve/CVE-2019-9125.htmlWed, 17 Jun 2026 02:43:07 +0000CRITICAL 9.8: An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header.CVE-2019-9124: An issue was discovered on D-Link DIR-878 1.12B01 deviceshttps://patchthecve.com/cve/CVE-2019-9124.htmlhttps://patchthecve.com/cve/CVE-2019-9124.htmlWed, 17 Jun 2026 02:43:07 +0000CRITICAL 9.8: An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password.CVE-2019-7297: An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03https://patchthecve.com/cve/CVE-2019-7297.htmlhttps://patchthecve.com/cve/CVE-2019-7297.htmlWed, 17 Jun 2026 02:40:24 +0000CRITICAL 9.8: An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system functiCVE-2018-20389: D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to dhttps://patchthecve.com/cve/CVE-2018-20389.htmlhttps://patchthecve.com/cve/CVE-2018-20389.htmlWed, 17 Jun 2026 01:52:45 +0000CRITICAL 9.8: D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.CVE-2018-18767: An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06https://patchthecve.com/cve/CVE-2018-18767.htmlhttps://patchthecve.com/cve/CVE-2018-18767.htmlWed, 17 Jun 2026 01:47:51 +0000HIGH 7.0: An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartCVE-2018-18442: D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (Dohttps://patchthecve.com/cve/CVE-2018-18442.htmlhttps://patchthecve.com/cve/CVE-2018-18442.htmlWed, 17 Jun 2026 01:47:18 +0000HIGH 7.5: D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., live-online video/audio streaming) by using the hping3 tool to perform an IPv4 flood attack. Verified attacks includes SYN floCVE-2018-18441: D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configurationhttps://patchthecve.com/cve/CVE-2018-18441.htmlhttps://patchthecve.com/cve/CVE-2018-18441.htmlWed, 17 Jun 2026 01:47:18 +0000HIGH 7.5: D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. CVE-2018-20305: D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpashttps://patchthecve.com/cve/CVE-2018-20305.htmlhttps://patchthecve.com/cve/CVE-2018-20305.htmlWed, 17 Jun 2026 01:52:35 +0000CRITICAL 9.8: D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address.CVE-2018-20057: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 deviceshttps://patchthecve.com/cve/CVE-2018-20057.htmlhttps://patchthecve.com/cve/CVE-2018-20057.htmlWed, 17 Jun 2026 01:52:13 +0000HIGH 8.8: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.CVE-2018-20056: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 deviceshttps://patchthecve.com/cve/CVE-2018-20056.htmlhttps://patchthecve.com/cve/CVE-2018-20056.htmlWed, 17 Jun 2026 01:52:13 +0000CRITICAL 9.8: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter.CVE-2018-18636: XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.https://patchthecve.com/cve/CVE-2018-18636.htmlhttps://patchthecve.com/cve/CVE-2018-18636.htmlWed, 17 Jun 2026 01:47:36 +0000MEDIUM 6.1: XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.CVE-2018-14081: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devicehttps://patchthecve.com/cve/CVE-2018-14081.htmlhttps://patchthecve.com/cve/CVE-2018-14081.htmlWed, 17 Jun 2026 01:40:37 +0000CRITICAL 9.8: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password and the WPA key, are stored in cleartext.CVE-2018-14080: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devicehttps://patchthecve.com/cve/CVE-2018-14080.htmlhttps://patchthecve.com/cve/CVE-2018-14080.htmlWed, 17 Jun 2026 01:40:36 +0000HIGH 7.5: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to download the configuration file.CVE-2018-17881: On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands withhttps://patchthecve.com/cve/CVE-2018-17881.htmlhttps://patchthecve.com/cve/CVE-2018-17881.htmlWed, 17 Jun 2026 01:46:27 +0000CRITICAL 9.8: On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.CVE-2018-17880: On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authhttps://patchthecve.com/cve/CVE-2018-17880.htmlhttps://patchthecve.com/cve/CVE-2018-17880.htmlWed, 17 Jun 2026 01:46:27 +0000HIGH 7.5: On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot.CVE-2018-17787: On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharactershttps://patchthecve.com/cve/CVE-2018-17787.htmlhttps://patchthecve.com/cve/CVE-2018-17787.htmlWed, 17 Jun 2026 01:46:20 +0000CRITICAL 9.8: On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent directly to the "system" library function.CVE-2018-17786: On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.https://patchthecve.com/cve/CVE-2018-17786.htmlhttps://patchthecve.com/cve/CVE-2018-17786.htmlWed, 17 Jun 2026 01:46:20 +0000CRITICAL 9.8: On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows remote attackers to execute arbitrary code.CVE-2018-16408: D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a Sethttps://patchthecve.com/cve/CVE-2018-16408.htmlhttps://patchthecve.com/cve/CVE-2018-16408.htmlWed, 17 Jun 2026 01:44:14 +0000HIGH 7.2: D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging admin access.CVE-2018-12103: An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1https://patchthecve.com/cve/CVE-2018-12103.htmlhttps://patchthecve.com/cve/CVE-2018-12103.htmlWed, 17 Jun 2026 01:37:09 +0000MEDIUM 6.5: An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revisions). Due to the predictability of the /docs/captcha_(number).jpeg URI, being locCVE-2018-6213: In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.https://patchthecve.com/cve/CVE-2018-6213.htmlhttps://patchthecve.com/cve/CVE-2018-6213.htmlWed, 17 Jun 2026 02:01:31 +0000CRITICAL 9.8: In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there is a hardcoded password of anonymous for the admin account.CVE-2018-6212: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, https://patchthecve.com/cve/CVE-2018-6212.htmlhttps://patchthecve.com/cve/CVE-2018-6212.htmlWed, 17 Jun 2026 02:01:31 +0000MEDIUM 6.1: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting (XSS) attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of CVE-2018-6211: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, https://patchthecve.com/cve/CVE-2018-6211.htmlhttps://patchthecve.com/cve/CVE-2018-6211.htmlWed, 17 Jun 2026 02:01:31 +0000HIGH 7.2: On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, OS command injection is possible as a result of incorrect processing of the res_buf parameter to index.cgi.CVE-2018-10968: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to https://patchthecve.com/cve/CVE-2018-10968.htmlhttps://patchthecve.com/cve/CVE-2018-10968.htmlWed, 17 Jun 2026 01:35:01 +0000CRITICAL 9.8: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, aka a backdoor access vulnerability.CVE-2018-10967: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject https://patchthecve.com/cve/CVE-2018-10967.htmlhttps://patchthecve.com/cve/CVE-2018-10967.htmlWed, 17 Jun 2026 01:35:01 +0000HIGH 8.8: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on the device with higher privileges, aka remote code execution.CVE-2018-11013: Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firhttps://patchthecve.com/cve/CVE-2018-11013.htmlhttps://patchthecve.com/cve/CVE-2018-11013.htmlWed, 17 Jun 2026 01:35:06 +0000CRITICAL 9.8: Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remote attackers to execute arbitrary code via a request with a long HTTP Host header.CVE-2018-10996: The weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to execute arbitraryhttps://patchthecve.com/cve/CVE-2018-10996.htmlhttps://patchthecve.com/cve/CVE-2018-10996.htmlWed, 17 Jun 2026 01:35:04 +0000CRITICAL 9.8: The weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a session.cgi?ACTION=logout request involving a long REMOTE_ADDR environment variable.CVE-2018-10750: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10750.htmlhttps://patchthecve.com/cve/CVE-2018-10750.htmlWed, 17 Jun 2026 01:34:37 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'staticGet' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'staticGet <node_name attr>' function and cause memory corruption. Furthermore, it is possiblCVE-2018-10749: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10749.htmlhttps://patchthecve.com/cve/CVE-2018-10749.htmlWed, 17 Jun 2026 01:34:37 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'commit' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'commit <node_name>' function and cause memory corruption. Furthermore, it is possible to redireCVE-2018-10748: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10748.htmlhttps://patchthecve.com/cve/CVE-2018-10748.htmlWed, 17 Jun 2026 01:34:37 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'show' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'show <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect tCVE-2018-10747: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10747.htmlhttps://patchthecve.com/cve/CVE-2018-10747.htmlWed, 17 Jun 2026 01:34:36 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as an 'unset' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'unset <node_name>' function and cause memory corruption. Furthermore, it is possible to redirecCVE-2018-10746: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10746.htmlhttps://patchthecve.com/cve/CVE-2018-10746.htmlWed, 17 Jun 2026 01:34:36 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'get <node_name attr>' function and cause memory corruption. Furthermore, it is possible to redirecCVE-2018-10713: An issue was discovered on D-Link DSL-3782 EU 1.01 deviceshttps://patchthecve.com/cve/CVE-2018-10713.htmlhttps://patchthecve.com/cve/CVE-2018-10713.htmlWed, 17 Jun 2026 01:34:33 +0000HIGH 8.8: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'read' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'read <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect tCVE-2018-10431: D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the Syhttps://patchthecve.com/cve/CVE-2018-10431.htmlhttps://patchthecve.com/cve/CVE-2018-10431.htmlWed, 17 Jun 2026 01:33:59 +0000HIGH 7.2: D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.CVE-2018-10110: D-Link DIR-615 T1 devices allow XSS via the Add User feature.https://patchthecve.com/cve/CVE-2018-10110.htmlhttps://patchthecve.com/cve/CVE-2018-10110.htmlWed, 17 Jun 2026 01:33:31 +0000MEDIUM 4.8: D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-8941: Diagnostics functionality on D-Link DSL-3782 devices with firmware EU vhttps://patchthecve.com/cve/CVE-2018-8941.htmlhttps://patchthecve.com/cve/CVE-2018-8941.htmlWed, 17 Jun 2026 02:05:41 +0000HIGH 8.8: Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v. 1.01 has a buffer overflow, allowing authenticated remote attackers to execute arbitrary code via a long Addr value to the 'set Diagnostics_Entry' function in an HTTP request, related to /userfs/bin/tcapi.CVE-2018-7698: An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 deviceshttps://patchthecve.com/cve/CVE-2018-7698.htmlhttps://patchthecve.com/cve/CVE-2018-7698.htmlWed, 17 Jun 2026 02:03:33 +0000HIGH 8.1: An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these crede