CVE-2024-57376

CVE-2024-57376 Pre-auth remote code execution exploit for D-Link DSR-250 and DSR-250N Security advisory: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Usage root@kitploit: $ python3 exploit.py usage: Example root@kitploit: $ python3 exploit.py 192.168.1.1 443 id...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

CVE-2025-26237

D-Link DI-7001 MINI5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of mspinfo, which can be exploited to run arbitrary commands...

CVE-2026-15270 D-link DIR-823G Web boa.conf least privilege violation

A weakness has been identified in D-link DIR-823G 1.0.2B0520181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The...

The vulnerability of D-Link DIR-513 router’s microprogramming software lies in the fact that the operation output goes beyond the buffer in memory, allowing a hacker to cause a malfunction in the device’s functionality.

The vulnerability of D-Link DIR-513 router’s microprogramming software lies in the fact that the operation data is written outside the buffer in memory when processing the webpage parameter. Exploiting this vulnerability allows a remote attacker to cause a service failure by sending specially...

The vulnerability of D-Link DIR-513 router microprogramming software, caused by buffer overflows, allows attackers to execute arbitrary code and trigger a service failure.

The vulnerability of D-Link DIR-513 router microprogramming software arises due to buffer overflow when processing the curTime parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failures...

The vulnerability of the formEasySetTimezone() function (/goform/formEasySetTimezone), a built-in microprogramming software function of the D-Link DIR-513 router’s web server, allows a malicious actor to cause a service failure.

The vulnerability of the formEasySetTimezone function /goform/formEasySetTimezone in the embedded web server software of D-Link DIR-513 routers is related to the issue of data being written outside of the buffer in memory when processing the curTime parameter. Exploiting this vulnerability could...

The vulnerability of D-Link DIR-513 router’s microprogramming software lies in the fact that the operation output goes beyond the buffer in memory, allowing a hacker to cause a malfunction in the device.

The vulnerability of D-Link DIR-513 router’s microprogrammed software is related to the operation of writing data outside the buffer in memory when processing the curTime parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability in the webfile_mgrc.ipl software for D-Link DNS-320 allows a hacker to execute arbitrary commands.

The vulnerability in the webfilemgrc.cgi script of the D-Link DNS-320 network storage software exists due to the lack of measures taken to neutralize special elements used in the operating system’s command syntax. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

CVE-2026-11492

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to...

The vulnerability of the sub_41CF20() function in the /boafrm/formUSSDSetup file of the D-Link DWR-M920 router’s microprogramming software allows a hacker to inject arbitrary commands.

The vulnerability of the sub41CF20 function in the /boafrm/formUSSDSetup file of the D-Link DWR-M920 router’s microprogramming system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to inject...

CVE-2026-11492

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to...

CVE-2026-11341

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEIvalue causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-11339

A vulnerability affects D-Link DWR-M920 firmware up to version 1.1.50 . The flaw is located in the function sub_41CF20 within the file /boafrm/formUSSDSetup ; manipulating the argument ussdValue enables command injection . It can be exploited remotely, and multiple sources note that the exploit i...

EUVD-2026-34859

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may ...

📄 D-Link DSL2600U Password Disclosure

D-Link DSL2600U suffers from an administrative password disclosure vulnerability. Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure Date: 2026-05-02 Exploit Author: Amir Hossein Jamshidi Vendor Homepage: https://www.dlink.com Version: DSL-2600U Tested on: ubuntu CVE : N/A Firmwar...

The vulnerability of the sub_4237AC() function in D-Link DWR-M960 router microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the sub4237AC function in D-Link DWR-M960 router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause malfunctions in the device...

D-Link DSL2600U - 'rom-0' Admin Password Disclosure

Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure Date: 2026-05-02 Exploit Author: Amir Hossein Jamshidi Vendor Homepage: https://www.dlink.com Version: DSL-2600U Tested on: ubuntu CVE : N/A Firmware Version: v1.08 from routersploit.libs.lzs.lzs import LZSDecompress import reques...

D-Link DIR-816 注入漏洞

The D-Link DIR-816 is a wireless router produced by D-Link Corporation. The D-Link DIR-816 1.10CNB05R1B011D88210 version has a vulnerability related to command injection, which stems from operations on the ipaddress parameter...

CVE-2026-8346 D-Link DIR-816 portForward command injection

A vulnerability was detected in D-Link DIR-816 1.10CNB05R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ipaddress results in command injection. The attack can be initiated remotely. The exploit is now public and may be used...