CVE-2024-0717

Affects a wide range of D-Link devices (e.g., DAP-1360, DIR-300, DIR-615, DIR-620, DVG-series, Good Line Router v2, and others) with the vulnerability residing in the HTTP GET Request Handler for /devinfo. The underlying issue is improper handling of the area parameter, where input such as notice...

CVE-2022-1262

The CVE-2022-1262 entry describes a command injection vulnerability in the protest binary that allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Connected documents confirm the issue but provide no concrete details on affected versions or f...

CVE-2022-28571

The CVE-2022-28571 affects the D-Link DIR-882 family (DIR882A1_FW130B06) and involves a command injection vulnerability in the /usr/bin/cli endpoint. Public sources describe the root cause as improper handling of symbolic links/data sanitization at the management interface, enabling an attacker t...

CVE-2022-28901

The CVE-2022-28901 entry describes a command injection in the D-Link DIR882 firmware (DIR882A1_FW130B06) specifically in the component path /SetTriggerLEDBlink/Blink that allows an attacker to escalate to root via a crafted payload. Multiple feeds (NVD/Red Hat/OpenVAS/CNNVD-CN etc.) corroborate t...

CVE-2022-28895

D-Link DIR882/DIR882A1_FW130B06 is affected by a command-injection in the /setnetworksettings/IPAddress component. The root-cause is improper handling of crafted payloads that enables privilege escalation to root. Impact is described as remote execution with full device compromise if exploited; C...

CVE-2021-44880

The connected OpenVAS entries confirm a vulnerability in D-Link DIR-878 and DIR-882 endpoints (DIR-878 <= 1.30B08, DIR-882

CVE-2022-28896

The CVE-2022-28896 issue affects D-Link DIR882/DIR882A1_FW130B06, with a command-injection in the /setnetworksettings/SubnetMask component that can allow an attacker to escalate to root. Public entries from NVD (CVSS v3.1 base score 9.8; network access, no user interaction) and Red Hat’s security...

CVE-2021-44881

CVE-2021-44881 affects D-Link DIR-882 devices, where DIR_882_FW1.30B06_Hotfix_02 contains a command-injection vulnerability in the twsystem function that allows arbitrary command execution via crafted HNAP1 POST requests. The issue is exploitable remotely over network (no user interaction) and ca...

CVE-2024-48632

D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08) wireless routers are vulnerable to multiple command injection vulnerabilities within the SetPortForwardingSettings function of the prog.cgi script. The root cause is the failure to properly neutralize special elements used in operating system comma...

CVE-2020-8863

Affected products: D-Link DIR-867, DIR-878, and DIR-882 routers running firmware 1.10B04. The vulnerability stems from how HNAP login requests are processed, resulting in an incomplete authentication implementation. This allows network-adjacent attackers to bypass authentication and escalate priv...

CVE-2021-45998

The CVE-2021-45998 vulnerability affects D-Link DIR-882 devices (firmware family around DIR-882_FW1.30B06_Hotfix_02 / Rev. A

CVE-2023-24330

The D-Link DIR-882 wireless router is susceptible to a command injection vulnerability in the HNAP1 protocol implementation, specifically affecting firmware version DIR882A1_FW130B06 . The root cause is the failure to neutralize special elements used in operating system commands. A malicious acto...

CVE-2024-48638

The D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) contain a command injection vulnerability in the SetGuestZoneRouterSettings function within the prog.cgi script. The root cause is the failure to neutralize special elements used in operating system commands when process...

CVE-2020-8864

The CVE-2020-8864 entry affects D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. The root cause is improper handling of empty passwords in HNAP login requests, leading to authentication bypass. An attacker on the network-adjacent segment could potentially execute arbitrary code...

CVE-2022-44804

D-Link DIR-882 firmware versions 1.10B02 through 1.20B06 contain a buffer overflow in the websRedirect() function due to insufficient input length validation. Public sources describe the issue as enabling denial of service or remote code execution if exploited, with the vulnerable component being...

CVE-2022-44806

CVE-2022-44806 affects D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. The vulnerability is a buffer overflow in the firmware (root cause: missing length validation in the wan_wan_phy_ifname path of function sub_46D180), enabling a remote attacker to potentially cause denial of service ...

CVE-2024-48635

D-Link DIR_882 (dual-band wireless router) and DIR_878 (wireless router) are affected by a command injection vulnerability (CWE-78) within the SetVLANSettings function of the prog.cgi script. The root cause is a failure to neutralize special elements used in operating system commands, specificall...

CVE-2022-44807

The CVE-2022-44807 entry concerns D-Link DIR-882 firmware versions 1.10B02 through 1.20B06. A buffer overflow in the webGetVarString() function is described as the root cause, allowing potential impact to confidentiality, integrity, and availability. Connected sources confirm the vulnerable compo...

CVE-2024-48633

D-Link DIR_882 (FW130B06) and DIR_878 (FW130B08) routers are vulnerable to command injection due to improper neutralization of special elements used in OS commands. The flaw exists within the SetVirtualServerSettings function of the prog.cgi script. Specifically, an attacker can execute arbitrary...

CVE-2024-48629

D-Link DIR_882_FW130B06 and DIR_878_FW130B08 routers are affected by a command injection vulnerability in the SetGuestZoneRouterSettings function. The flaw is caused by a lack of proper neutralization of special elements used in operating system commands when processing the IPAddress parameter. A...

CVE-2024-48631

D-Link DIR_882 (firmware FW130B06) and DIR_878 (firmware FW130B08) wireless routers are vulnerable to a command injection vulnerability. The flaw exists in the SetWlanRadioSettings() function within the prog.cgi script due to the failure to neutralize special elements used in operating system com...

CVE-2024-48634

D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) devices are susceptible to a command injection vulnerability. The flaw exists within the SetWlanRadioSecurity() function in the prog.cgi script of the router's microprogramming software. It is caused by a failure to neutrali...

CVE-2024-48630

D-Link DIR-882 (firmware FW130B06 ) and DIR-878 (firmware FW130B08 ) routers are susceptible to a command injection vulnerability. The flaw exists in the SetMACFilters2() function within the prog.cgi script due to a failure to neutralize special elements used in operating system commands. An atta...

CVE-2024-48636

The D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) are vulnerable to a command injection vulnerability in the SetVLANSettings function. The root cause is the failure to neutralize special elements used in operating system commands, specifically within the VLANID:0/VID pa...

CVE-2023-26925

The CVE-2023-26925 entry describes an information-disclosure issue in the Syslog functionality of D-LINK DIR-882 (firmware 1.30). The vulnerability arises from insufficient protection of service data, allowing a specially crafted network request to disclose sensitive information. Affected compone...

CVE-2024-48637

D-Link DIR_882 (firmware FW130B06 ) and DIR_878 (firmware DIR_878_FW130B08 ) routers are susceptible to a command injection vulnerability. The root cause is the failure to neutralize special elements used in operating system commands within the SetVLANSettings function of the prog.cgi script. An ...

CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 . The issue stems from the sub_432F60 function in the prog.cgi binary, which stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvram_safe_set. These values are subsequently ...

CVE-2026-5844

The CVE-2026-5844 entry describes a vulnerability in D-Link DIR-882 (firmware 1.01B02) affecting the HNAP1 SetNetworkSettings handler, specifically the prog.cgi function sprintf. Manipulating the IPAddress argument triggers an OS command injection, with remote exploitation possible. Public exploi...

CVE-2025-60697

A command injection vulnerability exists in the D-Link DIR-882 Router firmware (version DIR882A1_FW102B02 ). The issue originates from the sub_4438A4 function in the prog.cgi binary, which stores user-supplied DDNS parameters (ServerAddress and Hostname) in NVRAM via nvram_safe_set. These values ...

CVE-2025-60700

A command injection vulnerability exists in the D-Link DIR-882 Router firmware (version DIR882A1_FW102B02 ) within the prog.cgi and librcm.so binaries. The root cause is a lack of input sanitization where the sub_4455BC function in prog.cgi stores user-supplied SetDMZSettings/IPAddress values in ...

CVE-2025-60701

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 within the prog.cgi and rc binaries. The vulnerability occurs because the sub_433188 function in prog.cgi stores user-supplied email configuration parameters (such as EmailFrom and AccountName...