CVE-2019-10999

D-Link 漏洞利用 该漏洞存在于设备服务器 alphapd 在处理 wireless.htm 并将其显示给用户之前。如果在 URL 中提供了 WEPEncryption，且该值长度超过 0x28 字节，则将导致缓冲区溢出。URL 格式如下： root@kitploit: http://IPADDRESS/wireless.htm?WEPEncryption=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB 将触发该漏洞利用，并在 0x42424242 处开始执行。 注意：该漏洞利用需要凭证才能成功。 默认凭证为 admin，密码为空。...

CVE-2024-3273

Exploit de Ejecución de Comandos en NAS D-Link Este script de Python explota una vulnerabilidad CVE-2024-3273 en dispositivos NAS D-Link, permitiendo la ejecución arbitraria de comandos. Aprovecha la vulnerabilidad para ejecutar comandos de forma remota en los dispositivos afectados...

CVE-2025-22968

CVE-2025-22968 D-Link DWR-M972V 软件版本 1.05SSG 未授权访问漏洞 描述 D-Link DWR-M972V（软件版本 1.05SSG）默认配置中的未授权访问允许匿名攻击者通过公共访问访问路由器并上传恶意后门脚本。 漏洞类型 认证不当 供应商 D-Link 受影响产品代码库 D-Link DWR-M972V 软件版本 1.05SSG 受影响组件 路由器上的 RouterOS 攻击类型 远程 影响代码执行 是 影响信息泄露 是 攻击向量 为了利用该漏洞，匿名攻击者可以进行利用。 发现者 Chanon Temkamolsin，Weelapat Umarsa...

CVE-2026-86297

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnelsetparams of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peerhostname leads to off-by-one. The attack may be performe...

CVE-2026-86295

A vulnerability was found in D-Link DIR-895L A1102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-86296

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2026-86297 D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnelsetparams of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peerhostname leads to off-by-one. The attack may be performe...

EUVD-2026-72339

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnelsetparams of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peerhostname leads to off-by-one. The attack may be performe...

CVE-2026-86297

A remote off-by-one vulnerability exists in the L2TP Control Message Parser of the D-Link DIR-605 (firmware B1v202WWB03), specifically in the tunnel_set_params function of progs.gpl/pppd.alpha/l2tp/tunnel.c. Manipulation of the peer_hostname argument triggers the out-of-bounds condition. No authe...

EUVD-2026-72336

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2026-86296 D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2026-86296

D-Link DIR-822A (firmware A_101) is affected by a stack-based buffer overflow in the udhcpcd component, specifically in the strcpy call within serverpacket.c. The overflow is triggered during parsing of TR-111 Option 125 in DHCPv6 messages. The vulnerability is exploitable remotely without authen...

CVE-2026-86295 D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection

A vulnerability was found in D-Link DIR-895L A1102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-86295

A command injection vulnerability in D-Link DIR-895L (firmware A1_102b07) affects the sendACK function in the udhcpcd/serverpacket.c component. Manipulation of the Hostname argument allows remote, unauthenticated attackers to inject commands, with a CVSS 3.1 base score of 8.3 (HIGH) . A proof-of-...

EUVD-2026-72334

A vulnerability was found in D-Link DIR-895L A1102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2023-33781

CVE-2023-33781 描述 D-Link DIR-842V2 v1.0.3 被发现允许用户在连接 telnet 时运行任意二进制文件。此漏洞可通过备份/恢复功能触发。 概念验证...

PT-2026-86965

A flaw has been found in D-Link DIR-895L A1 102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published a...

PT-2026-86966

A vulnerability has been found in D-Link DIR-822A A 101. Affected is the function tunnel set params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

PT-2026-86569

A vulnerability was determined in D-Link DIR-822A A 101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been public...

PT-2026-86570

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel set params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer hostname leads to off-by-one. The attack may be...