CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2022-1262

The CVE-2022-1262 entry describes a command injection vulnerability in the protest binary that allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Connected documents confirm the issue but provide no concrete details on affected versions or f...

CVE-2021-30072

The CVE-2021-30072 entry concerns the D-Link DIR-878 router (version 1.30B08) and affects the prog.cgi component. The root cause is a misused strcat leading to a stack-based buffer overflow, which can be exploited without authentication over the network. Exploitation details are not provided in t...

CVE-2022-41140

Multiple D-Link routers , specifically the DIR-867 , DIR-878 , and DIR-882 models, are vulnerable to a stack-based buffer overflow. The flaw resides in the lighttpd service (defaulting to TCP port 80) due to insufficient validation of user-supplied data lengths prior to copying it into a fixed-le...

CVE-2022-26670

CVE-2022-26670 concerns the D-Link DIR-878 wireless router. The vulnerability stems from inadequate filtering for special characters in a webpage input field, enabling an unauthenticated LAN attacker to perform a command injection and execute arbitrary system commands. The available connected sou...

CVE-2021-44880

The connected OpenVAS entries confirm a vulnerability in D-Link DIR-878 and DIR-882 endpoints (DIR-878 <= 1.30B08, DIR-882

CVE-2020-8863

Affected products: D-Link DIR-867, DIR-878, and DIR-882 routers running firmware 1.10B04. The vulnerability stems from how HNAP login requests are processed, resulting in an incomplete authentication implementation. This allows network-adjacent attackers to bypass authentication and escalate priv...

CVE-2024-48632

D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08) wireless routers are vulnerable to multiple command injection vulnerabilities within the SetPortForwardingSettings function of the prog.cgi script. The root cause is the failure to properly neutralize special elements used in operating system comma...

CVE-2025-0481

CVE-2025-0481 affects D-Link DIR-878 (firmware 1.03). The issue is in an unknown function of the /dllog.cgi HTTP POST Request Handler, leading to information disclosure. It can be exploited remotely, and multiple sources describe public exploits or disclosures. The provided connected documents co...

CVE-2021-44882

CVE-2021-44882 affects the D-Link DIR-878 router family (firmware around 1.30B08 Hotfix 02). The issue is a command injection in the twsystem function that can be exploited by sending a crafted HNAP1 POST request, allowing an attacker to execute arbitrary commands remotely over the network with n...

CVE-2024-48638

The D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) contain a command injection vulnerability in the SetGuestZoneRouterSettings function within the prog.cgi script. The root cause is the failure to neutralize special elements used in operating system commands when process...

CVE-2022-44801

Affected product: D-Link DIR-878 router (firmware 1.02B05). Issue: incorrect access control allowing authentication bypass (e.g., login with a blank password) that could compromise confidentiality, integrity, and availability. Root cause: access control error in DIR-878 firmware. Exploitation sta...

CVE-2023-24800

CVE-2023-24800 affects D-Link DIR878 (FW120B05); a stack overflow in the sub_495220 function could enable a remote attacker to cause DoS or execute arbitrary code via a crafted payload. The vulnerability is network‑accessible; no official patch/version fix is detailed in the provided documents. A...

CVE-2020-8864

The CVE-2020-8864 entry affects D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. The root cause is improper handling of empty passwords in HNAP login requests, leading to authentication bypass. An attacker on the network-adjacent segment could potentially execute arbitrary code...

CVE-2022-43184

CVE-2022-43184 affects the D-Link DIR-878 router, specifically firmware 1.30B08 Hotfix_04, where a command injection vulnerability exists in the /bin/proc.cgi endpoint. The included documents indicate this could allow a remote attacker to execute arbitrary commands (potential remote code executio...

CVE-2023-24798

CVE-2023-24798 affects the D-Link DIR878/DIR_878_FW120B05 with a reported stack overflow in the function named sub_475FB0. The vulnerability can cause a Denial of Service or allow arbitrary code execution via a crafted payload over the network. Documented impact is high (critical), with network a...

CVE-2022-44202

The CVE-2022-44202 entry applies to D-Link DIR878/DIR823G family firmware. Affected firmware versions are 1.02B04 and 1.02B05, where a buffer overflow is caused by insufficient length validation in the sub_4883F0 function. Attackers could potentially exploit this for denial of service or remote c...

CVE-2019-8316

CVE-2019-8316 (D-Link DIR-878) involves a command injection in firmware 1.12A1 where any HNAP API function can trigger execution of system commands via untrusted input in the WebFilterURLs field of SetWebFilterSettings, delivered through a crafted /HNAP1 POST request. The vulnerability allows a r...

CVE-2023-27720

CVE-2023-27720 affects D-Link DIR878, firmware 1.30B08. A stack overflow in the sub_48d630 function can be exploited remotely via a crafted payload to cause DoS or execute arbitrary code. Exploitation status is not detailed in the provided documents. A temporary workaround mentioned in PT-2023-72...

CVE-2024-48629

D-Link DIR_882_FW130B06 and DIR_878_FW130B08 routers are affected by a command injection vulnerability in the SetGuestZoneRouterSettings function. The flaw is caused by a lack of proper neutralization of special elements used in operating system commands when processing the IPAddress parameter. A...

CVE-2019-8314

The CVE-2019-8314 vulnerability affects D-Link DIR-878 devices with firmware 1.12A1. It is a remote command-injection in the HNAP API (SetQoSSettings) where untrusted input in the IPAddress field can trigger a system() call via crafted /HNAP1 POST requests, allowing arbitrary OS commands and pote...

CVE-2024-48633

D-Link DIR_882 (FW130B06) and DIR_878 (FW130B08) routers are vulnerable to command injection due to improper neutralization of special elements used in OS commands. The flaw exists within the SetVirtualServerSettings function of the prog.cgi script. Specifically, an attacker can execute arbitrary...

CVE-2024-48631

D-Link DIR_882 (firmware FW130B06) and DIR_878 (firmware FW130B08) wireless routers are vulnerable to a command injection vulnerability. The flaw exists in the SetWlanRadioSettings() function within the prog.cgi script due to the failure to neutralize special elements used in operating system com...

CVE-2024-48635

D-Link DIR_882 (dual-band wireless router) and DIR_878 (wireless router) are affected by a command injection vulnerability (CWE-78) within the SetVLANSettings function of the prog.cgi script. The root cause is a failure to neutralize special elements used in operating system commands, specificall...

CVE-2024-48634

D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) devices are susceptible to a command injection vulnerability. The flaw exists within the SetWlanRadioSecurity() function in the prog.cgi script of the router's microprogramming software. It is caused by a failure to neutrali...

CVE-2024-48630

D-Link DIR-882 (firmware FW130B06 ) and DIR-878 (firmware FW130B08 ) routers are susceptible to a command injection vulnerability. The flaw exists in the SetMACFilters2() function within the prog.cgi script due to a failure to neutralize special elements used in operating system commands. An atta...

CVE-2019-8312

The CVE-2019-8312 entry affects D-Link DIR-878 devices running firmware 1.12A1. Affected component: HNAP API functionality, specifically SetSysLogSettings. Root cause: untrusted input in the IPAddress field is processed via a call to the twsystem function, enabling a remote attacker to inject com...

CVE-2023-24799

CVE-2023-24799 affects D-Link DIR878 (DIR_878_FW120B05). The issue is a stack overflow in the sub_48AF78 function, enabling Denial of Service or arbitrary code execution via a crafted payload. Documents consistently identify the vulnerable component and impact (DoS and potential code execution) b...

CVE-2019-8318

A Command Injection vulnerability exists in D-Link DIR-878 devices running firmware 1.12A1 . The flaw occurs because the SetSysEmailSettings API function fails to properly sanitize input data before passing it to the twsystem function. An attacker can exploit this by sending a crafted /HNAP1 POST...

CVE-2025-60672

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router running firmware FW101B04.bin . The flaw resides in the SetDynamicDNSSettings functionality, where the ServerAddress and Hostname parameters in prog.cgi are stored in NVRAM without proper validation. These pa...

CVE-2019-8315

The CVE-2019-8315 issue affects D-Link DIR-878 devices running firmware 1.12A1. It is a Command Injection vulnerability where an attacker can craft a /HNAP1 POST request that triggers a call to twsystem with untrusted input from the request body (SetIPv4FirewallSettings API), demonstrated by shel...

CVE-2024-48636

The D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) are vulnerable to a command injection vulnerability in the SetVLANSettings function. The root cause is the failure to neutralize special elements used in operating system commands, specifically within the VLANID:0/VID pa...

CVE-2019-8319

CVE-2019-8319 affects D-Link DIR-878 devices with firmware 1.12A1. The issue is a command injection vulnerability in the HNAP API: when any HNAP function calls system() with untrusted input from the request body for SetStaticRouteIPv4Settings, crafted values in the Gateway field can lead to execu...

CVE-2019-8313

CVE-2019-8313 affects D‑Link DIR-878 devices running firmware 1.12A1. The issue is a Command Injection vulnerability where an attacker can execute arbitrary OS commands via a crafted /HNAP1 POST request. The root cause is input from the request body being passed to the internal twsystem function ...

CVE-2019-8317

CVE-2019-8317 affects D-Link DIR-878 devices running firmware 1.12A1. The issue is a Command Injection via a crafted /HNAP1 POST request, where an HNAP API function invokes system with untrusted input from the request body (SetStaticRouteIPv6Settings) and shell metacharacters appear in the DestNe...

CVE-2024-48637

D-Link DIR_882 (firmware FW130B06 ) and DIR_878 (firmware DIR_878_FW130B08 ) routers are susceptible to a command injection vulnerability. The root cause is the failure to neutralize special elements used in operating system commands within the SetVLANSettings function of the prog.cgi script. An ...

CVE-2025-60673

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware (FW101B04.bin ). The flaw is located in the SetDMZSettings functionality within the prog.cgi script, where the IPAddress parameter is stored in NVRAM without proper validation. This parameter is subs...

CVE-2025-60674

A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware (FW101B04.bin ) within the rc binary's USB storage handling module. The flaw occurs because the **

CVE-2025-60676

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware (FW101B04.bin ). The flaw resides in the SetNetworkSettings functionality of the prog.cgi script, where the IPAddress and SubnetMask parameters are directly concatenated into shell commands executed ...