CVE-2019-17621

CVE-2019-17621 affects the D-Link DIR-859 router (firmware 1.05/1.06B01 Beta01). The issue is an unauthenticated remote command-execution vulnerability via the UPnP endpoint at /gena.cgi. An attacker on the local network can send a crafted HTTP SUBSCRIBE request to the UPnP service and execute sy...

CVE-2016-6563

CVE-2016-6563 describes a stack-based buffer overflow in the HNAP login path of certain D-Link DIR routers when processing malformed SOAP messages. Affected models include DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L. The overflow occurs in the HNA...

CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2019-20213

D-Link DIR-859 routers are affected by CVE-2019-20213: unauthenticated information disclosure via the AUTHORIZED_GROUP=1%0a value demonstrated by vpnconfig.php on devices running versions prior to 1.07b03_beta. The vulnerability enables exposure of information over the network with no authenticat...

CVE-2016-5681

CVE-2016-5681 is a stack-based buffer overflow in D-Link DIR-850L B1, DIR-817 Ax, DIR-818LW Bx, DIR-822 C1, DIR-823 A1, DIR-895L A1, DIR-890L A1, DIR-885L A1, DIR-880L A1, DIR-868L B1, and DIR-868L C1 where a long session cookie to dws/api/Login can cause remote code execution. Public sources con...

CVE-2018-19987

CVE-2018-19987 affects multiple D-Link devices (DIR-822 Rev.B/Rev.C, DIR-860L Rev.B, DIR-868L Rev.B, DIR-880L Rev.A, DIR-890L Rev.A). The vulnerability is in /HNAP1/SetAccessPointMode and is caused by how the IsAccessPoint parameter is handled in SetAccessPointMode.php: it is saved to the ShellPa...

CVE-2018-19989

CVE-2018-19989 affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 via the /HNAP1/SetQoSSettings uplink parameter. In SetQoSSettings.php the uplink value is saved to internal memory at /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth without any regex validation and later consumed by...

CVE-2023-51984

CVE-2023-51984 affects D-Link DIR-822+ (V1.0.2). The vulnerability is a command injection in the SetStaticRouteSettings function that allows remote attackers to execute arbitrary commands via the shell. Sources from multiple feeds (NVD, Red Hat, CNVD, CNNVD, CVE List) corroborate the impact descr...

CVE-2023-51987

CVE-2023-51987 affects D-Link DIR-822+ router (V1.0.2). The HNAP1 interface contains a login bypass that lets an attacker log in to an administrator account using an empty password. Root cause: missing authentication in HNAP1. Impact: potential unauthorized admin access with high confidentiality,...

CVE-2018-20675

The CVE-2018-20675 entry affects multiple D-Link devices: DIR-822 C1 (before v3.11B01Beta), DIR-822-US C1 (before v3.11B01Beta), DIR-850L A* (before v1.21B08Beta), DIR-850L B* (before v2.22B03Beta), and DIR-880L A* (before v1.20B02Beta). The issue is an authentication bypass, reported across thes...

CVE-2018-20674

The vulnerability CVE-2018-20674 affects multiple D-Link wireless routers (DIR-822 C1/US C1, DIR-850L A*/B*, DIR-880L A*) prior to specific Beta firmware versions (e.g., v3.11B01Beta for DIR-822/US; v1.21B08Beta for DIR-850L A*, v2.22B03Beta for DIR-850L B*, v1.20B02Beta for DIR-880L A*). It enab...

CVE-2026-7067

CVE-2026-7067 refers to a command injection in D-Link DIR-822 A_101’s udhcpd DHCP Service (file /udhcpcd/dhcpd.c, function system). The vulnerability stems from manipulating the Hostname argument, enabling remote code execution. Exploitation is possible over the network, with a publicly disclosed...