CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2022-1262

The CVE-2022-1262 entry describes a command injection vulnerability in the protest binary that allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Connected documents confirm the issue but provide no concrete details on affected versions or f...

CVE-2022-28571

The CVE-2022-28571 affects the D-Link DIR-882 family (DIR882A1_FW130B06) and involves a command injection vulnerability in the /usr/bin/cli endpoint. Public sources describe the root cause as improper handling of symbolic links/data sanitization at the management interface, enabling an attacker t...

CVE-2022-28901

The CVE-2022-28901 entry describes a command injection in the D-Link DIR882 firmware (DIR882A1_FW130B06) specifically in the component path /SetTriggerLEDBlink/Blink that allows an attacker to escalate to root via a crafted payload. Multiple feeds (NVD/Red Hat/OpenVAS/CNNVD-CN etc.) corroborate t...

CVE-2021-44880

The connected OpenVAS entries confirm a vulnerability in D-Link DIR-878 and DIR-882 endpoints (DIR-878 <= 1.30B08, DIR-882

CVE-2022-28895

D-Link DIR882/DIR882A1_FW130B06 is affected by a command-injection in the /setnetworksettings/IPAddress component. The root-cause is improper handling of crafted payloads that enables privilege escalation to root. Impact is described as remote execution with full device compromise if exploited; C...

CVE-2022-28896

The CVE-2022-28896 issue affects D-Link DIR882/DIR882A1_FW130B06, with a command-injection in the /setnetworksettings/SubnetMask component that can allow an attacker to escalate to root. Public entries from NVD (CVSS v3.1 base score 9.8; network access, no user interaction) and Red Hat’s security...

CVE-2021-44881

CVE-2021-44881 affects D-Link DIR-882 devices, where DIR_882_FW1.30B06_Hotfix_02 contains a command-injection vulnerability in the twsystem function that allows arbitrary command execution via crafted HNAP1 POST requests. The issue is exploitable remotely over network (no user interaction) and ca...

CVE-2021-45998

The CVE-2021-45998 vulnerability affects D-Link DIR-882 devices (firmware family around DIR-882_FW1.30B06_Hotfix_02 / Rev. A

CVE-2020-8863

Affected products: D-Link DIR-867, DIR-878, and DIR-882 routers running firmware 1.10B04. The vulnerability stems from how HNAP login requests are processed, resulting in an incomplete authentication implementation. This allows network-adjacent attackers to bypass authentication and escalate priv...

CVE-2024-48632

The D-Link DIR-878 and DIR-882 routers (specifically firmware versions DIR_882_FW130B06 and DIR_878_FW130B08 ) are vulnerable to multiple command injection flaws in the SetPortForwardingSettings function within the prog.cgi script. The root cause is the failure to neutralize special elements used...

CVE-2024-48638

D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08) wireless routers are vulnerable to a command injection vulnerability. The root cause is the failure to neutralize special elements in the SubnetMask parameter within the SetGuestZoneRouterSettings function of the prog.cgi script. A remote attacker ...

CVE-2020-8864

The CVE-2020-8864 entry affects D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. The root cause is improper handling of empty passwords in HNAP login requests, leading to authentication bypass. An attacker on the network-adjacent segment could potentially execute arbitrary code...

CVE-2023-24330

Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.

CVE-2022-44804

D-Link DIR-882 firmware versions 1.10B02 through 1.20B06 contain a buffer overflow in the websRedirect() function due to insufficient input length validation. Public sources describe the issue as enabling denial of service or remote code execution if exploited, with the vulnerable component being...

CVE-2022-44806

CVE-2022-44806 affects D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. The vulnerability is a buffer overflow in the firmware (root cause: missing length validation in the wan_wan_phy_ifname path of function sub_46D180), enabling a remote attacker to potentially cause denial of service ...

CVE-2022-44807

The CVE-2022-44807 entry concerns D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. A buffer overflow in the webGetVarString() function is described as the root cause, allowing potential impact to confidentiality, integrity, and availability. Connected sources confirm the vulnerable compo...

CVE-2024-48629

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVE-2024-48633

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arb...

CVE-2024-48630

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVE-2024-48634

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVE-2024-48635

D-Link DIR_882_FW130B06 and DIR_878_FW130B08 wireless routers are susceptible to a command injection vulnerability in the SetVLANSettings function within the prog.cgi script. The root cause is a failure to neutralize special characters used in operating system commands, specifically via the VLANI...

CVE-2024-48636

The D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 routers are susceptible to a command injection vulnerability within the SetVLANSettings function. The flaw exists because the system fails to neutralize special elements used in operating system commands when processing the VLANID:0/VID par...

CVE-2024-48631

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVE-2024-48637

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVE-2023-26925

The CVE-2023-26925 entry describes an information-disclosure issue in the Syslog functionality of D-LINK DIR-882 (firmware 1.30). The vulnerability arises from insufficient protection of service data, allowing a specially crafted network request to disclose sensitive information. Affected compone...

CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 . The issue originates because the sub_432F60 function in the prog.cgi binary stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvram_safe_set. These values are subsequently...

CVE-2026-5844

The CVE-2026-5844 entry describes a vulnerability in D-Link DIR-882 (firmware 1.01B02) affecting the HNAP1 SetNetworkSettings handler, specifically the prog.cgi function sprintf. Manipulating the IPAddress argument triggers an OS command injection, with remote exploitation possible. Public exploi...

CVE-2025-60697

A command injection vulnerability exists in the D-Link DIR-882 Router firmware (version DIR882A1_FW102B02 ) within the prog.cgi and rc binaries. The sub_4438A4 function in prog.cgi stores user-supplied DDNS parameters (ServerAddress and Hostname) into NVRAM via nvram_safe_set. These values are su...

CVE-2025-60701

A command injection vulnerability exists in the D-Link DIR-882 Router firmware (specifically version DIR882A1_FW102B02 ). The issue stems from the sub_433188 function in the prog.cgi binary, which stores user-supplied email configuration parameters—such as EmailFrom, EmailTo, SMTPServerAddress, S...

CVE-2025-60700

A command injection vulnerability exists in the D-Link DIR-882 router firmware, specifically affecting version DIR882A1_FW102B02 (and versions prior to it). The flaw resides in the prog.cgi and librcm.so binaries, where the sub_4455BC function stores user-supplied SetDMZSettings/IPAddress values ...