CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2022-1262

The CVE-2022-1262 entry describes a command injection vulnerability in the protest binary that allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Connected documents confirm the issue but provide no concrete details on affected versions or f...

CVE-2022-41140

CVE-2022-41140 is a vulnerability in multiple D-Link routers (DIR-867, DIR-878, DIR-882) where the lighttpd service fails to validate the length of user-supplied data before copying to a fixed-length stack buffer. This allows network-adjacent attackers to execute arbitrary code with root privileg...

CVE-2022-26670

CVE-2022-26670 concerns the D-Link DIR-878 wireless router. The vulnerability stems from inadequate filtering for special characters in a webpage input field, enabling an unauthenticated LAN attacker to perform a command injection and execute arbitrary system commands. The available connected sou...

CVE-2021-30072

The CVE-2021-30072 entry concerns the D-Link DIR-878 router (version 1.30B08) and affects the prog.cgi component. The root cause is a misused strcat leading to a stack-based buffer overflow, which can be exploited without authentication over the network. Exploitation details are not provided in t...

CVE-2021-44880

The connected OpenVAS entries confirm a vulnerability in D-Link DIR-878 and DIR-882 endpoints (DIR-878 <= 1.30B08, DIR-882

CVE-2024-48632

D-Link DIR-878 (DIR 878 FW130B08) and DIR-882 (DIR 882 FW130B06) routers are affected by command-injection vulnerabilities in SetPortForwardingSettings implemented in prog.cgi. The root cause is improper neutralization of input (LocalIPAddress, TCPPorts, UDPPorts) that enables remote attackers to...

CVE-2020-8863

Affected products: D-Link DIR-867, DIR-878, and DIR-882 routers running firmware 1.10B04. The vulnerability stems from how HNAP login requests are processed, resulting in an incomplete authentication implementation. This allows network-adjacent attackers to bypass authentication and escalate priv...

CVE-2021-44882

CVE-2021-44882 affects the D-Link DIR-878 router family (firmware around 1.30B08 Hotfix 02). The issue is a command injection in the twsystem function that can be exploited by sending a crafted HNAP1 POST request, allowing an attacker to execute arbitrary commands remotely over the network with n...

CVE-2020-8864

The CVE-2020-8864 entry affects D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. The root cause is improper handling of empty passwords in HNAP login requests, leading to authentication bypass. An attacker on the network-adjacent segment could potentially execute arbitrary code...

CVE-2025-0481

CVE-2025-0481 affects D-Link DIR-878 (firmware 1.03). The issue is in an unknown function of the /dllog.cgi HTTP POST Request Handler, leading to information disclosure. It can be exploited remotely, and multiple sources describe public exploits or disclosures. The provided connected documents co...

CVE-2022-43184

CVE-2022-43184 affects the D-Link DIR-878 router, specifically firmware 1.30B08 Hotfix_04, where a command injection vulnerability exists in the /bin/proc.cgi endpoint. The included documents indicate this could allow a remote attacker to execute arbitrary commands (potential remote code executio...

CVE-2024-48638

CVE-2024-48638 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). The vulnerability is a command injection in SetGuestZoneRouterSettings via the SubnetMask parameter, allowing an attacker to execute arbitrary OS commands through a crafted POST request. The CVSSv3.1 vector is AV:A/AC:L/PR:L...

CVE-2022-44801

Affected product: D-Link DIR-878 router (firmware 1.02B05). Issue: incorrect access control allowing authentication bypass (e.g., login with a blank password) that could compromise confidentiality, integrity, and availability. Root cause: access control error in DIR-878 firmware. Exploitation sta...

CVE-2023-27720

CVE-2023-27720 affects D-Link DIR878, firmware 1.30B08. A stack overflow in the sub_48d630 function can be exploited remotely via a crafted payload to cause DoS or execute arbitrary code. Exploitation status is not detailed in the provided documents. A temporary workaround mentioned in PT-2023-72...

CVE-2024-48629

The CVE-2024-48629 entry concerns D-Link DIR-882 and DIR-878 devices (firmware DIR_882_FW130B06 and DIR_878_FW130B08) with a command-injection vulnerability in SetGuestZoneRouterSettings via the IPAddress parameter. Exploitation could allow an attacker to execute arbitrary OS commands through a c...

CVE-2022-44202

The CVE-2022-44202 entry applies to D-Link DIR878/DIR823G family firmware. Affected firmware versions are 1.02B04 and 1.02B05, where a buffer overflow is caused by insufficient length validation in the sub_4883F0 function. Attackers could potentially exploit this for denial of service or remote c...

CVE-2024-48633

CVE-2024-48633 affects D-Link DIR-882 firmware DIR_882_FW130B06 and DIR-878 firmware DIR_878_FW130B08. The vulnerability exists in SetVirtualServerSettings, where input parameters ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress can be abused to inject OS commands. An attacker can t...

CVE-2024-48634

Summary : CVE-2024-48634 affects D-Link DIR-882 (firmware FW130B06) and DIR-878 (FW130B08). The vulnerability is a command injection in the SetWLanRadioSecurity function, exploitable via the key parameter through a crafted POST request, enabling arbitrary OS commands. The issue arises from insuff...

CVE-2019-8314

The CVE-2019-8314 vulnerability affects D-Link DIR-878 devices with firmware 1.12A1. It is a remote command-injection in the HNAP API (SetQoSSettings) where untrusted input in the IPAddress field can trigger a system() call via crafted /HNAP1 POST requests, allowing arbitrary OS commands and pote...

CVE-2019-8316

CVE-2019-8316 (D-Link DIR-878) involves a command injection in firmware 1.12A1 where any HNAP API function can trigger execution of system commands via untrusted input in the WebFilterURLs field of SetWebFilterSettings, delivered through a crafted /HNAP1 POST request. The vulnerability allows a r...

CVE-2023-24798

CVE-2023-24798 affects the D-Link DIR878/DIR_878_FW120B05 with a reported stack overflow in the function named sub_475FB0. The vulnerability can cause a Denial of Service or allow arbitrary code execution via a crafted payload over the network. Documented impact is high (critical), with network a...

CVE-2024-48630

CVE-2024-48630 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). The vulnerability arises from insufficient input sanitization in the SetMACFilters2 MacAddress parameter, allowing an attacker to inject and execute OS commands via a crafted POST request. The CVSSv3.1 details indicate adjac...

CVE-2024-48635

D-Link DIR-882 (firmware FW130B06) and DIR-878 (firmware FW130B08) expose a command injection in SetVLANSettings. The root cause is a lack of neutralization of special elements in the VLANID:2/VID parameter, allowing an attacker to run arbitrary OS commands via a crafted POST request. Public sour...

CVE-2019-8312

The CVE-2019-8312 entry affects D-Link DIR-878 devices running firmware 1.12A1. Affected component: HNAP API functionality, specifically SetSysLogSettings. Root cause: untrusted input in the IPAddress field is processed via a call to the twsystem function, enabling a remote attacker to inject com...

CVE-2023-24799

CVE-2023-24799 affects D-Link DIR878 (DIR_878_FW120B05). The issue is a stack overflow in the sub_48AF78 function, enabling Denial of Service or arbitrary code execution via a crafted payload. Documents consistently identify the vulnerable component and impact (DoS and potential code execution) b...

CVE-2023-24800

CVE-2023-24800 affects D-Link DIR878 (FW120B05); a stack overflow in the sub_495220 function could enable a remote attacker to cause DoS or execute arbitrary code via a crafted payload. The vulnerability is network‑accessible; no official patch/version fix is detailed in the provided documents. A...

CVE-2019-8313

CVE-2019-8313 affects D‑Link DIR-878 devices running firmware 1.12A1. The issue is a Command Injection vulnerability where an attacker can execute arbitrary OS commands via a crafted /HNAP1 POST request. The root cause is input from the request body being passed to the internal twsystem function ...

CVE-2019-8318

CVE-2019-8318 concerns D-Link DIR-878 devices (firmware 1.12A1) with a command injection vulnerability. The issue arises when an HNAP API function triggers a call to the twsystem function using untrusted input from the request body, specifically via the SetSysEmailSettings API and illustrated by ...

CVE-2019-8319

CVE-2019-8319 affects D-Link DIR-878 devices with firmware 1.12A1. The issue is a command injection vulnerability in the HNAP API: when any HNAP function calls system() with untrusted input from the request body for SetStaticRouteIPv4Settings, crafted values in the Gateway field can lead to execu...

CVE-2024-48631

CVE-2024-48631 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). A command-injection vulnerability exists in the SetWLanRadioSettings function, enabling an attacker to execute arbitrary OS commands via a crafted POST request to the SSID parameter. Public documents describe impact as remot...

CVE-2024-48636

D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08) are affected by CVE-2024-48636, a command-injection in SetVLANSettings that allows arbitrary OS commands via a crafted POST to VLANID:0/VID. Root cause cited across sources is insufficient neutralization of special elements used in OS commands. Exp...

CVE-2024-48637

CVE-2024-48637 affects D-Link DIR-878 and DIR-882 (firmware DIR-878 FW130B08; DIR-882 FW130B06). Root cause: lack of neutralization of special elements in SetVLANSettings (prog.cgi) allowing command injection via VLANID:1/VID parameter in a crafted POST request. Impact: remote attacker can execut...

CVE-2019-8315

The CVE-2019-8315 issue affects D-Link DIR-878 devices running firmware 1.12A1. It is a Command Injection vulnerability where an attacker can craft a /HNAP1 POST request that triggers a call to twsystem with untrusted input from the request body (SetIPv4FirewallSettings API), demonstrated by shel...

CVE-2019-8317

CVE-2019-8317 affects D-Link DIR-878 devices running firmware 1.12A1. The issue is a Command Injection via a crafted /HNAP1 POST request, where an HNAP API function invokes system with untrusted input from the request body (SetStaticRouteIPv6Settings) and shell metacharacters appear in the DestNe...

CVE-2025-60672

CVE-2025-60672 affects the D-Link DIR-878A1 router (firmware FW101B04.bin). The vulnerability is an unauthenticated command-injection in the SetDynamicDNSSettings function, where ServerAddress and Hostname parameters in prog.cgi are stored in NVRAM and later used by rc to build system commands ex...

CVE-2025-60673

CVE-2025-60673 describes an unauthenticated command-injection vulnerability in the D-Link DIR-878A1 router, firmware FW101B04.bin. The flaw exists in SetDMZSettings where the IPAddress parameter in prog.cgi is stored in NVRAM and later used by librcm.so to build iptables commands executed via tws...

CVE-2025-60674

CVE-2025-60674 affects D-Link DIR-878A1 router firmware FW101B04.bin in the rc USB storage handling module. The flaw occurs when reading the USB device’s Serial Number with sscanf into a 64-byte stack buffer while fgets can read up to 127 bytes, causing a stack overflow. An attacker with physical...

CVE-2025-60676

The CVE-2025-60676 entry concerns the D-Link DIR-878A1 router, firmware FW101B04.bin. Technical details across multiple connected sources confirm an unauthenticated command-injection in prog.cgi SetNetworkSettings, where IPAddress and SubnetMask are directly concatenated into shell commands execu...