ZeusQA
Start free

Known exploited vulnerabilities

D-Link vulnerabilities attackers have used

Every D-Link vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 26 D-Link vulnerabilities as exploited in the wild, 2 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2025-29635, added Apr 24, 2026. Multiple Routers has the most entries (3).

In KEV, all time
26
Added, last 12 months
2
Used in ransomware
2
New CVEs this week
3

By product

Multiple Routers (3), DCS-2530L and DCS-2670L Devices (2), DIR-859 Router (2), Multiple NAS Devices (2), DCS-930L Devices (1), DIR-300 Router (1), DIR-600 Router (1), DIR-605 Router (1), DIR-610 Devices (1), DIR-645 Router (1), DIR-820 Router (1), DIR-820L (1), and 9 more.

New Critical and High D-Link CVEs this week

  • CVE-2026-125086criticalA vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
  • CVE-2026-124563highA security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and…
  • CVE-2026-124560criticalA vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could…

Every D-Link entry in CISA KEV

  1. CVE-2025-29635

    Added · due

    D-Link DIR-823X Command Injection Vulnerability

    D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted…

  2. CVE-2022-37055

    Added · due

    D-Link Routers Buffer Overflow Vulnerability

    D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product…

  3. CVE-2022-40799

    Added · due

    D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

    D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service…

  4. CVE-2020-25079

    Added · due

    D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

    D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  5. CVE-2020-25078

    Added · due

    D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

    D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should…

  6. CVE-2024-0769

    Added · due

    D-Link DIR-859 Router Path Traversal Vulnerability

    D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml…

  7. CVE-2023-25280

    Added · due

    D-Link DIR-820 Router OS Command Injection Vulnerability

    D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

  8. CVE-2021-40655

    Added · due

    D-Link DIR-605 Router Information Disclosure Vulnerability

    D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

  9. CVE-2014-100005

    Added · due

    D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

    D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.

  10. CVE-2024-3273

    Added · due

    D-Link Multiple NAS Devices Command Injection Vulnerability

    D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

  11. CVE-2024-3272

    Added · due

    D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

    D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.

  12. CVE-2016-20017

    Added · due

    D-Link DSL-2750B Devices Command Injection Vulnerability

    D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.

  13. CVE-2019-20500

    Added · due

    D-Link DWL-2600AP Access Point Command Injection Vulnerability

    D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or…

  14. CVE-2019-17621

    Added · due

    D-Link DIR-859 Router Command Execution Vulnerability

    D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE…

  15. CVE-2022-26258

    Added · due

    D-Link DIR-820L Remote Code Execution Vulnerability

    D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.

  16. CVE-2018-6530

    RansomwareAdded · due

    D-Link Multiple Routers OS Command Injection Vulnerability

    Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

  17. CVE-2011-4723

    Added · due

    D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.

  18. CVE-2019-16057

    RansomwareAdded · due

    D-Link DNS-320 Remote Code Execution Vulnerability

    The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.

  19. CVE-2021-45382

    Added · due

    D-Link Multiple Routers Remote Code Execution Vulnerability

    A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

  20. CVE-2020-9377

    Added · due

    D-Link DIR-610 Devices Remote Command Execution

    D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.

  21. CVE-2019-16920

    Added · due

    D-Link Multiple Routers Command Injection Vulnerability

    Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.

  22. CVE-2016-11021

    Added · due

    D-Link DCS-930L Devices OS Command Injection Vulnerability

    setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.

  23. CVE-2013-5223

    Added · due

    D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

    A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

  24. CVE-2015-2051

    Added · due

    D-Link DIR-645 Router Remote Code Execution Vulnerability

    D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

  25. CVE-2020-29557

    Added · due

    D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability

    D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.

  26. CVE-2020-25506

    Added · due

    D-Link DNS-320 Device Command Injection Vulnerability

    D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works