CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2025-5623

CVE-2025-5623 affects D-Link DIR-816 firmware 1.10CNB05, targeting the qosClassifier function in /goform/qosClassifier. The vulnerability enables a remote, stack-based buffer overflow through manipulation of dip_address/sip_address arguments, with high impact on confidentiality, integrity, and av...

CVE-2021-31326

The CVE-2021-31326 entry concerns a vulnerability in the D-Link DIR-816 A2 with firmware 1.10 B05. A crafted tokenid parameter sent to /goform/form2Reboot.cgi allows unauthenticated attackers to arbitrarily reset the device, indicating a command/injection-like weakness that enables device reset w...

CVE-2025-5630

CVE-2025-5630 affects the D-Link DIR-816 router (firmware 1.10CNB05). The vulnerability exists in the /goform/form2lansetup.cgi endpoint, where manipulating the ip parameter leads to a stack-based buffer overflow. This allows remote exploitation and can impact confidentiality, integrity, and avai...

CVE-2022-29324

The CVE-2022-29324 entry concerns D-Link DIR-816 A2 firmware (v1.10CNB04). A stack overflow exists when processing the proto parameter in /goform/form2IPQoSTcAdd, caused by untrusted input handling at a boundary condition. Reported effects include potential remote code execution or device crash. ...

CVE-2025-1392

The CVE-2025-1392 entry applies to D-Link DIR-816 (firmware 1.01TO). The vulnerability is an XSS flaw in handling the SSID parameter via /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic, which can be triggered remotely. Multiple connected sources confirm the issue is t...

CVE-2022-37125

CVE-2022-37125 affects D-Link DIR-816 A2, specifically the /goform/NTPSyncWithHost endpoint. The connected documents consistently indicate a command injection vulnerability in the DIR-816 A2_v1.10CNB04.img, enabling arbitrary command execution via that API. The CVE entry lists a high/critical imp...

CVE-2022-28915

CVE-2022-28915 affects D-Link DIR-816 A2 (firmware v1.10CNB04). The vulnerability is a command-injection in the /goform/setSysAdm API, exploitable via the admuser and admpass parameters, enabling arbitrary command execution. Several connected sources corroborate theffected device and vector; some...

CVE-2022-29325

The CVE-2022-29325 entry affects D-Link DIR-816 A2 routers running firmware v1.10CNB04, where a stack overflow can be triggered via the addurlfilter parameter in /goform/websURLFilter. Public records (CNVD, CNNVD, NVD, Red Hat, CVE Registry) describe a boundary error in handling untrusted input t...

CVE-2022-29322

CVE-2022-29322 affects D-Link DIR-816 A2_v1.10CNB04. The vulnerability is a stack overflow caused by a boundary error in the IPADDR and nvmacaddr parameters processed by /goform/form2Dhcpip, potentially allowing arbitrary code execution or a system crash. Exploitation details are not provided in ...

CVE-2022-29326

The CVE-2022-29326 case concerns the D-Link DIR-816 A2_v1.10CNB04 wireless router, where a stack-based buffer overflow is triggered via the addhostfilter parameter in /goform/websHostFilter. Multiple connected sources describe a boundary/error condition in processing untrusted input leading to po...

CVE-2022-29327

CVE-2022-29327 affects the D-Link DIR-816 A2_v1.10CNB04 router. A boundary/stack overflow is triggered by the urladd parameter in /goform/websURLFilterAddDel, caused by processing untrusted input. Impact per sources: potential arbitrary code execution or a system crash. Exploitation details are n...

CVE-2024-57681

CVE-2024-57681 affects the D-Link DIR-816A2 router, specifically the component form2alg.cgi in firmware DIR-816A2_FWv1.10CNB05_R1B011D88210. The vulnerability is an access control flaw that allows unauthenticated attackers to configure the device’s agl service via a crafted POST request. The CVSS...

CVE-2022-29321

The CVE-2022-29321 entry affects the D-Link DIR-816 A2_firmware (v1.10CNB04) and is caused by a stack overflow in the lanip parameter handled by /goform/setNetworkLan. Public records describe a boundary error that can be exploited to execute arbitrary code or cause a system crash; impact is a cri...

CVE-2022-29323

The CVE-2022-29323 entry affects D-Link DIR-816 A2_v1.10CNB04. A stack/buffer overflow is triggered by the MAC parameter in the /goform/editassignment handler. The vulnerability could allow arbitrary code execution or a system crash, as indicated by the connected records. No remediation or patch ...

CVE-2025-5620

DVE- CVE-2025-5620 affects D-Link DIR-816. The vulnerability is in the function setipsec_config (file /goform/setipsec_config) where manipulation of localIP/remoteIP leads to OS command injection. Remote exploitation is possible, and vulnerability affects firmware 1.10CNB05; the issue is tied to ...

CVE-2024-57682

CVE-2024-57682 affects D-Link DIR-816A2 devices (firmware 1.10CNB05_R1B011D88210) in the component d_status.asp . The vulnerability is an information disclosure that allows unauthenticated attackers to access sensitive information via a crafted POST request. The available documents consistently d...

CVE-2022-42999

CVE-2022-42999 affects the D-Link DIR-816 A2 router (firmware 1.10 B05). The root cause is command injection in the web API endpoint at /goform/setSysAdm, exploitable through the admuser and admpass parameters. The issue can lead to arbitrary command execution with high impact, notably a High CVS...

CVE-2025-5624

D-Link DIR-816 (firmware 1.10CNB05) contains a stack-based buffer overflow in QoSPortSetup (/goform/QoSPortSetup). By manipulating port0_group/port0_remarker/ssid0_group/ssid0_remarker, an attacker can remotely trigger overflow, potentially leading to arbitrary code execution or denial of service...

CVE-2022-43003

CVE-2022-43003 affects D-Link DIR-816 A2 router with firmware 1.10 B05. The vulnerability is a stack overflow in the setRepeaterSecurity function triggered via the pskValue parameter, impacting confidentiality, integrity, and availability (CVSS v3.1: 9.8). Connected documents corroborate a buffer...

CVE-2024-13102

CVE-2024-13102 concerns a critical flaw in the D-Link DIR-816 A2 (firmware 1.10CNB05_R1B011D88210) where the DDNS Service’s /goform/DDNS path allows improper access control. The vulnerability enables remote attackers to manipulate DDNS settings and potentially access sensitive information. Multip...

CVE-2025-5622

CVE-2025-5622 affects the D-Link DIR-816 router (firmware 1.10CNB05). The vulnerability is a stack-based buffer overflow in the function wirelessApcli_5g within /goform/wirelessApcli_5g, triggered by improper length validation of arguments apcli_mode_5g/apcli_enc_5g/apcli_default_key_5g. It can b...

CVE-2022-43000

Affected product: D-Link DIR-816 A2 router (firmware 1.10 B05). Vulnerability: stack overflow in the /goform/form2WizardStep4 handler, triggered via the wizardstep4_pskpwd parameter. Root cause: improper handling in wizardstep4_pskpwd processing leading to potential memory corruption. Impact: hig...

CVE-2022-43001

CVE-2022-43001 affects D-Link DIR-816 A2, version 1.10 B05, with a stack overflow in the setSecurity function’s pskValue parameter. The vulnerability is documented with a high-impact CVSS v3.1 score (9.8, CRITICAL) across network attack vector, no user interaction, and impacts to confidentiality,...

CVE-2025-29743

CVE-2025-29743 affects D-Link DIR-816 A2V1.1.0B05, with a command injection flaw in the /goform/delRouting endpoint. The issue is confirmed across multiple sources; the root cause is a vulnerability in a router management path that could allow injected commands. The CVSS v3.1 score is 6.5 (NETWOR...

CVE-2024-13105

The CVE-2024-13105 entry affects D-Link DIR-816 A2, specifically the DHCPD Setting Handler in /goform/form2Dhcpd.cgi. Affects version 1.10CNB05_R1B011D88210. Root cause is improper access controls on the DHCPD component, enabling a remote attacker to manipulate DHCP settings. In public sources, t...

CVE-2021-39510

The CVE-2021-39510 entry documents a vulnerability in D-Link DIR816_A1_FW101CNB04 750m11ac routers. Affected component: the HTTP handler for /goform/form2userconfig.cgi, where an HTTP request parameter is used to compose a username string for the delete-user function. Root cause: improper handlin...

CVE-2024-13106

CVE-2024-13106 affects D-Link DIR-816 A2 firmware (1.10CNB05_R1B011D88210), specifically the IP QoS Handler’s file /goform/form2IPQoSTcAdd. The root cause is improper access controls in that endpoint, enabling a remote attacker to manipulate QoS settings. Descriptions across sources confirm remot...

CVE-2022-37128

CVE-2022-37128 affects D-Link DIR-816 A2 with firmware image v1.10CNB04 (DIR-816 A2). The vulnerability allows initializing the network without authentication via the API endpoint "/goform/wizard_end". Impact is described as critical (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No exploit det...

CVE-2022-43002

The CVE-2022-43002 entry concerns a D-Link DIR-816 A2 device with firmware 1.10 B05 (noted in multiple sources). The vulnerability is a stack overflow in the wizardstep54_pskpwd parameter handled by /goform/form2WizardStep54, affecting the network-facing form. CVSS metrics indicate a CRITICAL imp...

CVE-2024-57678

CVE-2024-57678 affects D-Link DIR-816A2 DIR-816 devices via the form2WlAc.cgi component. The issue is an access control error that allows unauthenticated attackers to modify the 2.4G and 5G MAC access control lists through a crafted POST request. Affected firmware shown in sources is DIR-816A2_FW...

CVE-2024-57680

CVE-2024-57680 concerns a D-Link DIR-816A2 router vulnerability in the form2PortriggerRule.cgi component. The issue is an access control error that allows unauthenticated attackers to set the device port trigger via a crafted POST request to /form2PortriggerRule.cgi, affecting D-Link DIR-816A2_FW...

CVE-2024-13103

This CVE-2024-13103 affects D-Link DIR-816 A2 with firmware 1.10CNB05_R1B011D88210. The vulnerability resides in the Virtual Service Handler’s /goform/form2AddVrtsrv.cgi and is due to improper access controls, enabling remote abuse of virtual services. The exploit is publicly disclosed. Practical...

CVE-2024-13104

CVE-2024-13104 affects the D-Link DIR-816 A2 router (firmware 1.10CNB05_R1B011D88210). The vulnerability resides in an unknown function within the WiFi Settings Handler file /goform/form2AdvanceSetup.cgi, causing improper access controls that enable a remote attacker to modify 2.4 GHz and 5 GHz a...

CVE-2019-10040

The CVE-2019-10040 issue affects the D-Link DIR-816 A2 (firmware 1.11). The vulnerability arises because the router only checks a random token when authorizing a goform request; an attacker can obtain this token from dir_login.asp and use the hidden API URL /goform/SystemCommand to execute a syst...

CVE-2022-42998

The CVE-2022-42998 entry concerns the D-Link DIR-816 A2 router (firmware 1.10 B05). A stack overflow is triggered via the srcip parameter in the /goform/form2IPQoSTcAdd endpoint. This affects the device’s firmware and is rated critical (CVSSv3.1: AV Network, AC Low, PR None, UI None, S Unchanged;...

CVE-2024-57676

CVE-2024-57676 affects D-Link DIR-816A2 with FW v1.10CNB05_R1B011D88210. The vulnerability is an access-control flaw in the form2WlanBasicSetup.cgi component, allowing unauthenticated attackers to via a crafted POST request enable/modify the 2.4 GHz and 5 GHz WLAN services. Connected sources conf...

CVE-2019-7642

D-Link routers with the mydlink feature expose some web interfaces without authentication, enabling a remote attacker to obtain users’ DNS query logs and login logs. Affected models include DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10). Co...

CVE-2024-13108

CVE-2024-13108 affects the D-Link DIR-816 A2 router (firmware version 1.10CNB05_R1B011D88210). The issue is an access control failure in the /goform/form2NetSniper.cgi handler that can be triggered remotely, with the exploit disclosed publicly. Multiple sources concur on improper access controls ...

CVE-2022-36619

CVE-2022-36619 affects D-Link DIR-816 DIR-816 firmware A2_v1.10CNB04.img. The vulnerability, rooted in the /goform/setMAC endpoint, allows an unauthenticated reset of the device over the network. Reported impact aligns with high severity (CVSS 3.1: Network, no user interaction, availability impac...

CVE-2022-36620

The CVE-2022-36620 vulnerability affects D-Link DIR-816 A2 (v1.10CNB04) and DIR-878 (FW1.30B08.img). A buffer overflow can be triggered via the /goform/addRouting endpoint, as described in multiple feeds. The CVE entry notes a high severity (CVSS v3.1: 7.5, NETWORK access, no authentication, avai...

CVE-2023-24331

Affected device: D-Link DIR-816 router, firmware DIR-816_A2_v1.10CNB04. Issue: Command Injection via the urlAdd parameter that enables attackers to execute arbitrary commands. Documents do not specify exploit details beyond this vector or a concrete remediation; no explicit exploit availability i...

CVE-2024-57677

CVE-2024-57677 describes an access-control flaw in the D-Link 816A2 DIR-816 firmware (form2Wan.cgi) that allows unauthenticated attackers to configure the device’s WAN service via a crafted POST request. Root cause per documents: improper access control on the form2Wan.cgi endpoint, enabling mani...

CVE-2022-37133

The CVE-2022-37133 entry concerns D-Link DIR-816 DIR-816 A2 firmware A2_v1.10CNB04.img. The issue allows rebooting the router without authentication via the /goform/doReboot endpoint; a reboot is executed when the function returns, with no authentication required. This yields an impact to availab...

CVE-2021-39509

The advisory concerns CVE-2021-39509 affecting D-Link DIR-816 (DIR-816A2_FWv1.10CNB05_R1B011D88210). The HTTP parameter in /goform/form2userconfig.cgi is used to construct a username string for the delete-user function, enabling command injection via shell metacharacters. Affected component: the ...

CVE-2022-37134

CVE-2022-37134 affects D-Link DIR-816 A2 v1.10CNB04.img. The vulnerability is a buffer/stack overflow in /goform/form2Wan.cgi when wantype is 3: l2tp_usrname is base64-decoded into v94 without verifying size, leading to a stack overflow and potential code execution. Documented impacts include cod...

CVE-2024-24321

CVE-2024-24321 affects D-Link DIR-816A2 v1.10CNB05. A vulnerability in the sub_42DA54 function’s wizardstep4_ssid_2 parameter enables remote code execution, exploitable over the network with no user interaction. Reported impact is arbitrary code execution, with high confidentiality, integrity, an...

CVE-2025-5621

CVE-2025-5621 describes an OS command injection in the D-Link DIR-816 router, targeting the function qosClassifier in /goform/qosClassifier. The vulnerability arises from manipulating the dip_address/sip_address arguments, enabling remote exploitation and high impact. Reported affected firmware i...

CVE-2022-37129

CVE-2022-37129 affects the D-Link DIR-816 A2 with firmware version 1.10CNB04. The vulnerability is a remote command injection via the HTTP endpoint /goform/SystemCommand . User-supplied parameter “command” is spliced into a local buffer (byte_4836B0) using snprintf and then executed through a cal...

CVE-2024-57679

The CVE-2024-57679 issue affects D-Link DIR-816A2, firmware 1.10CNB05_R1B011D88210, due to an access-control flaw in form2RepeaterSetup.cgi. An unauthenticated attacker can craft a POST request to configure the 2.4G and 5G repeater services. The PT-2025-3537 report additionally notes the conditio...