CVE-2018-6530

The CVE-2018-6530 entry describes an OS command injection in the D‑Link DIR series through soap.cgi (soapcgi_main in cgibin), allowing remote execution of arbitrary OS commands via the service parameter. Affected devices include DIR-880L (REVA firmware patches 1.08B04 and earlier), DIR-868L (DIR8...

CVE-2018-20114

CVE-2018-20114 affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03. It is tied to an OS command injection in the cgibin soap.cgi service, exploitable via the service parameter containing an ? substring, reflecting an incomplete fix for CVE-2018-6530. Connected documents corrobora...

CVE-2018-6528

CVE-2018-6528 refers to an XSS flaw in D-Link DIR-860L/865L/868L routers (bsc_sms_send.php) that allows a remote attacker to read cookies via a crafted receiver parameter to soap.cgi. Root cause: improper input validation in htdocs/webinc/body/bsc_sms_send.php. Affected firmware versions include ...

CVE-2024-42812

CVE-2024-42812 affects D-Link DIR-860L firmware v2.03, due to a missing length check in the SID field of gena.cgi, causing a buffer overflow that can crash the device or allow arbitrary commands. OpenVAS and other feeds classify impact as high/critical (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A...

CVE-2018-6529

The CVE-2018-6529 issue affects D-Link DIR-868L, DIR-865L, and DIR-860L routers (DIR868LA1 FW112b04 and earlier; DIR865L REVA FW1.08.B01 and earlier; DIR860LA1 FW110b04 and earlier). It is an XSS in htdocs/webinc/js/bsc_sms_inbox.php that allows remote attackers to read a cookie by sending a craf...

CVE-2018-6527

The CVE-2018-6527 issue affects D-Link DIR-868L, DIR-865L and DIR-860L routers. It is a cookie disclosure via an XSS-like flaw in htdocs/webinc/js/adv_parent_ctrl_map.php that can be triggered by a crafted deviceid parameter to soap.cgi, exposing cookie data. Root cause: inadequate protection of ...

CVE-2024-41611

CVE-2024-41611 affects the D-Link DIR-860L REVA router firmware PATCH 1.10..B04, where the Telnet service contains hardcoded credentials , enabling remote login and execution of arbitrary commands. The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD/CNNVD/OpenVAS entries) an...

CVE-2024-37605

CVE-2024-37605 concerns the D-Link DIR-860L DIR-860L RE VB firmware 2.04.B04_ic5b. The issue is a NULL pointer dereference in the firmware that can be triggered by a crafted HTTP request, leading to a Denial of Service. Affected component: D-Link DIR-860L firmware (REVB 2.04.B04 ic5b). Impact: av...

CVE-2020-25786

CVE-2020-25786 affects D-Link DIR-816L (2.06.B09_BETA) and DIR-803 (1.04.B02). A flaw in webinc/js/info.php allows XSS via the HTTP Referer header . Public notes: affected products are no longer supported by the maintainer; exploitability is typically limited due to URL encoding (except in Intern...

CVE-2025-9026

CVE-2025-9026 affects D-Link DIR-860L (firmware 2.04.B04). The vulnerability is in the Simple Service Discovery Protocol component, specifically the ssdpcgi_main function in htdocs/cgibin, enabling remote OS command injection. Publicly disclosed exploit indicates active risk, with impact on confi...