CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2022-1262

The CVE-2022-1262 entry describes a command injection vulnerability in the protest binary that allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Connected documents confirm the issue but provide no concrete details on affected versions or f...

CVE-2022-28901

The CVE-2022-28901 entry describes a command injection in the D-Link DIR882 firmware (DIR882A1_FW130B06) specifically in the component path /SetTriggerLEDBlink/Blink that allows an attacker to escalate to root via a crafted payload. Multiple feeds (NVD/Red Hat/OpenVAS/CNNVD-CN etc.) corroborate t...

CVE-2022-28571

The CVE-2022-28571 affects the D-Link DIR-882 family (DIR882A1_FW130B06) and involves a command injection vulnerability in the /usr/bin/cli endpoint. Public sources describe the root cause as improper handling of symbolic links/data sanitization at the management interface, enabling an attacker t...

CVE-2022-28895

D-Link DIR882/DIR882A1_FW130B06 is affected by a command-injection in the /setnetworksettings/IPAddress component. The root-cause is improper handling of crafted payloads that enables privilege escalation to root. Impact is described as remote execution with full device compromise if exploited; C...

CVE-2022-28896

The CVE-2022-28896 issue affects D-Link DIR882/DIR882A1_FW130B06, with a command-injection in the /setnetworksettings/SubnetMask component that can allow an attacker to escalate to root. Public entries from NVD (CVSS v3.1 base score 9.8; network access, no user interaction) and Red Hat’s security...

CVE-2021-44880

The connected OpenVAS entries confirm a vulnerability in D-Link DIR-878 and DIR-882 endpoints (DIR-878 <= 1.30B08, DIR-882

CVE-2021-44881

CVE-2021-44881 affects D-Link DIR-882 devices, where DIR_882_FW1.30B06_Hotfix_02 contains a command-injection vulnerability in the twsystem function that allows arbitrary command execution via crafted HNAP1 POST requests. The issue is exploitable remotely over network (no user interaction) and ca...

CVE-2024-48632

D-Link DIR-878 (DIR 878 FW130B08) and DIR-882 (DIR 882 FW130B06) routers are affected by command-injection vulnerabilities in SetPortForwardingSettings implemented in prog.cgi. The root cause is improper neutralization of input (LocalIPAddress, TCPPorts, UDPPorts) that enables remote attackers to...

CVE-2020-8863

Affected products: D-Link DIR-867, DIR-878, and DIR-882 routers running firmware 1.10B04. The vulnerability stems from how HNAP login requests are processed, resulting in an incomplete authentication implementation. This allows network-adjacent attackers to bypass authentication and escalate priv...

CVE-2021-45998

The CVE-2021-45998 vulnerability affects D-Link DIR-882 devices (firmware family around DIR-882_FW1.30B06_Hotfix_02 / Rev. A

CVE-2020-8864

The CVE-2020-8864 entry affects D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. The root cause is improper handling of empty passwords in HNAP login requests, leading to authentication bypass. An attacker on the network-adjacent segment could potentially execute arbitrary code...

CVE-2022-44804

D-Link DIR-882 firmware versions 1.10B02 through 1.20B06 contain a buffer overflow in the websRedirect() function due to insufficient input length validation. Public sources describe the issue as enabling denial of service or remote code execution if exploited, with the vulnerable component being...

CVE-2024-48638

CVE-2024-48638 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). The vulnerability is a command injection in SetGuestZoneRouterSettings via the SubnetMask parameter, allowing an attacker to execute arbitrary OS commands through a crafted POST request. The CVSSv3.1 vector is AV:A/AC:L/PR:L...

CVE-2022-44806

CVE-2022-44806 affects D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. The vulnerability is a buffer overflow in the firmware (root cause: missing length validation in the wan_wan_phy_ifname path of function sub_46D180), enabling a remote attacker to potentially cause denial of service ...

CVE-2022-44807

The CVE-2022-44807 entry concerns D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. A buffer overflow in the webGetVarString() function is described as the root cause, allowing potential impact to confidentiality, integrity, and availability. Connected sources confirm the vulnerable compo...

CVE-2024-48629

The CVE-2024-48629 entry concerns D-Link DIR-882 and DIR-878 devices (firmware DIR_882_FW130B06 and DIR_878_FW130B08) with a command-injection vulnerability in SetGuestZoneRouterSettings via the IPAddress parameter. Exploitation could allow an attacker to execute arbitrary OS commands through a c...

CVE-2024-48633

CVE-2024-48633 affects D-Link DIR-882 firmware DIR_882_FW130B06 and DIR-878 firmware DIR_878_FW130B08. The vulnerability exists in SetVirtualServerSettings, where input parameters ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress can be abused to inject OS commands. An attacker can t...

CVE-2024-48634

Summary : CVE-2024-48634 affects D-Link DIR-882 (firmware FW130B06) and DIR-878 (FW130B08). The vulnerability is a command injection in the SetWLanRadioSecurity function, exploitable via the key parameter through a crafted POST request, enabling arbitrary OS commands. The issue arises from insuff...

CVE-2024-48630

CVE-2024-48630 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). The vulnerability arises from insufficient input sanitization in the SetMACFilters2 MacAddress parameter, allowing an attacker to inject and execute OS commands via a crafted POST request. The CVSSv3.1 details indicate adjac...

CVE-2024-48635

D-Link DIR-882 (firmware FW130B06) and DIR-878 (firmware FW130B08) expose a command injection in SetVLANSettings. The root cause is a lack of neutralization of special elements in the VLANID:2/VID parameter, allowing an attacker to run arbitrary OS commands via a crafted POST request. Public sour...

CVE-2024-48631

CVE-2024-48631 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). A command-injection vulnerability exists in the SetWLanRadioSettings function, enabling an attacker to execute arbitrary OS commands via a crafted POST request to the SSID parameter. Public documents describe impact as remot...

CVE-2024-48637

CVE-2024-48637 affects D-Link DIR-878 and DIR-882 (firmware DIR-878 FW130B08; DIR-882 FW130B06). Root cause: lack of neutralization of special elements in SetVLANSettings (prog.cgi) allowing command injection via VLANID:1/VID parameter in a crafted POST request. Impact: remote attacker can execut...

CVE-2023-24330

Summary: D-Link DIR-882 devices with firmware DIR882A1_FW130B06 are reported vulnerable to a command-injection via a crafted POST to /HNAP1/, allowing remote attackers with no privileges to execute arbitrary commands. Impact: CVSS v3.1 base score 8.8 (HIGH); Confidentiality, Integrity, and Availa...

CVE-2024-48636

D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08) are affected by CVE-2024-48636, a command-injection in SetVLANSettings that allows arbitrary OS commands via a crafted POST to VLANID:0/VID. Root cause cited across sources is insufficient neutralization of special elements used in OS commands. Exp...

CVE-2023-26925

The CVE-2023-26925 entry describes an information-disclosure issue in the Syslog functionality of D-LINK DIR-882 (firmware 1.30). The vulnerability arises from insufficient protection of service data, allowing a specially crafted network request to disclose sensitive information. Affected compone...

CVE-2025-60698

The CVE-2025-60698 issue affects D-Link DIR-882 router firmware DIR882A1_FW102B02, where SetSysLogSettings/IPAddress stored in NVRAM via nvram_safe_set can be read and concatenated into a shell command executed by twsystem() in the rc binary. The root cause is un-sanitized retrieval of nvram valu...

CVE-2026-5844

The CVE-2026-5844 entry describes a vulnerability in D-Link DIR-882 (firmware 1.01B02) affecting the HNAP1 SetNetworkSettings handler, specifically the prog.cgi function sprintf. Manipulating the IPAddress argument triggers an OS command injection, with remote exploitation possible. Public exploi...

CVE-2025-60697

Affects: D-Link DIR-882 router firmware (DIR882A1_FW102B02). Vulnerable path: prog.cgi (sub_4438A4) stores user-controlled DDNS fields (ServerAddress, Hostname) in NVRAM via nvram_safe_set; rc (start_DDNS_ipv4) reads them via nvram_safe_get, concatenates into DDNS commands, and executes with twsy...

CVE-2025-60701

The CVE-2025-60701 issue affects the D-Link DIR-882 router, specifically firmware DIR882A1_FW102B02. The vulnerability stems from the prog.cgi function sub_433188 and the rc binary’s sub_448FDC, where user-supplied EmailFrom, EmailTo, SMTPServerAddress, SMTPServerPort, and AccountName are stored ...

CVE-2025-60700

CVE-2025-60700 (D-Link DIR-882) affects DIR-882 routers running DIR882A1_FW102B02 and later?in the provided docs, the vulnerability lies in prog.cgi and librcm.so. The sub_4455BC function stores user-supplied SetDMZSettings/IPAddress values in NVRAM then DMZ_run reads them, concatenates them into...