CVE-2025-60676: Improper Neutralization of Special Elements used in a Command

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed...

CVE-2025-60672: Improper Neutralization of Special Elements used in a Command

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSSettings' functionality, where the 'ServerAddress' and 'Hostname' parameters in prog.cgi are stored in NVRAM and later used by rc to...

CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 . The issue stems from the sub_432F60 function in the prog.cgi binary, which stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvram_safe_set. These values are subsequently ...

PT-2025-47840

Name of the Vulnerable Software and Affected Versions D-Link DIR-822K versions 1.00 20250513164613 D-Link DWR-M920 versions 1.00 20250513164613 and 1.1.50 Description A buffer overflow issue exists in D-Link DIR-822K and DWR-M920. The issue is located in the file /boafrm/formFirewallAdv...

PT-2025-47839

Name of the Vulnerable Software and Affected Versions D-Link DIR-822K versions 1.00 20250513164613 through 1.1.50 D-Link DWR-M920 versions 1.00 20250513164613 through 1.1.50 Description A flaw exists in D-Link DIR-822K and DWR-M920 routers. The issue is related to the manipulation of the submit-u...

PT-2025-47842

Name of the Vulnerable Software and Affected Versions D-Link DIR-822K versions 1.00 20250513164613 and 1.1.50 D-Link DWR-M920 versions 1.00 20250513164613 and 1.1.50 Description A buffer overflow issue exists in D-Link DIR-822K and DWR-M920 devices. The issue is due to the manipulation of the...

PT-2025-47224

Name of the Vulnerable Software and Affected Versions D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M version 1.01.07 Description A weakness exists in D-Link routers that involves improper processing of the host argument within the /boafrm/formTracerouteDiagnosticRun file. Manipulation...

PT-2025-47212

Name of the Vulnerable Software and Affected Versions D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961, and DIR-825M versions 1.01.07 through 1.1.47 Description A security issue has been identified in D-Link routers, specifically affecting the models DWR-M920, DWR-M921, DWR-M960, DWR-M961, and...

CVE-2022-50596

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within...

CVE-2022-50596

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within...

CVE-2022-50596 D-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command Injection

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within...

CVE-2022-50596

CVE-2022-50596 affects D-Link DIR-1260 router firmware up to v1.20B05. The vulnerability is a pre-auth, command-injection flaw in the web management interface, exploitable via SetDest/Dest/Target arguments to the GetDeviceSettings form. Impact is unauthenticated command execution with root privil...

PT-2025-45371

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within...

CVE-2022-50596: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within...

D-Link DIR-1260 安全漏洞

D-Link DIR-1260 is a wireless router from China AUO D-Link. A security vulnerability exists in D-Link DIR-1260 v1.20B05 and earlier versions, which originates from a command injection in the SetDest/Dest/Target parameter in the web management interface, which could lead to an unauthenticated...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: exfat: Added a check for the cluster chain loop in dir functions. An infinite loop may occur if the following conditions occur due to file system corruption: 1 Condition for exfatcountdirEntries to loop infinitely: - The clust...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: gfs2: Validating idepth for exhash directories A fuzzer test introduced corruption where the depth of the directory reached 0 in direread. This caused an undefined shift of 32 bits at the line: index = hash 32 - dip-idepth; As...

D-Link DIR-823G Buffer Overflow Vulnerability (CNVD-2025-26157)

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from a buffer overflow vulnerability that stems from the FillMacCloneMac parameter failing to properly validate the length size of input data, which can be exploited by an attacker to cause a denial of...

PT-2025-47045

Name of the Vulnerable Software and Affected Versions D-Link DIR-816L version 2 06 b09 beta Description A stack-based buffer overflow exists in the scandir main function of the /portal/ ajax exporer.sgi file. This flaw can be exploited remotely. The argument en can be manipulated to trigger the...

The vulnerability of the phpcgi_main() function in D-Link DIR-852 router microprogramming software allows a hacker to disclose confidential information.

The vulnerability of the phpcgimain function in D-Link DIR-852 router microprogramming software is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose confidential information remotely...