Vendor
D-Link
859 known vulnerabilities.
Products
107 results · Clear filters · Feed
-
Critical 9.8
D-Link DIR-816 QoSPortSetup stack-based overflow
A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /goform/QoSPortSetup. The manipulation of the argument port0_group/port0_remarker/ssid0_group/ssid0_remar…
-
Critical 9.8CVE-2025-5623 EPSS 20%
D-Link DIR-816 qosClassifier stack-based overflow
A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been classified as critical. This affects the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to stack-based buffer overflow…
-
Critical 9.8
D-Link DIR-816 wirelessApcli_5g stack-based overflow
A vulnerability was found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this issue is the function wirelessApcli_5g of the file /goform/wirelessApcli_5g. The manipulation of the argument apcli_mode_5g/apcli_enc_5g/apcli_default_key_5g le…
-
Critical 9.8
D-Link DAP-1620 storage check_dws_cookie stack-based overflow
A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipulation of the argument uid leads to stack-based buffer overflow. The attack may be initiated remotel…
-
Critical 9.8CVE-2025-2620 Public exploit
D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow
A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer ov…
-
Critical 9.8
D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow
A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to ini…
-
Critical 9.8
D-Link DAP-1620 Path api set_ws_action heap-based overflow
A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The atta…
-
Critical 9.8
D-Link DSL6740C - Incorrect Use of Privileged APIs
The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.
-
Critical 9.8
D-Link WiFi router - OS Command Injection
Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the…
-
Critical 9.8
D-Link WiFi router - Hidden Functionality
Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.
-
Critical 9.8
D-Link WiFi router - Stack-based Buffer Overflow
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
-
Critical 9.8
D-Link WiFi router - Stack-based Buffer Overflow
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
-
Critical 9.8
D-Link - CWE-294: Authentication Bypass by Capture-replay
D-Link - CWE-294: Authentication Bypass by Capture-replay
-
Critical 9.8
D-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel
D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel
-
Critical 9.8
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability…
-
Critical 9.8
D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability
D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit …
-
Critical 9.8
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this …
-
Critical 9.8CVE-2023-32169 EPSS 56%
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability…
-
Critical 9.8CVE-2023-32165 EPSS 73%
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulne…
-
Critical 9.8
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the co…
KEV Apr 11, 2024 -
Critical 9.6
D-Link DAP-1650 SUBSCRIBE Callback Command Injection Vulnerability
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
-
Critical 9.6
D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability
A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
-
Critical 10.0
D-Link D-View 8 Unauthenticated Probe-Core Server Communication
A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could result in the disclosure of information from other probes, denial of service conditions due to the …
-
Critical 9.8
Authentication Bypass in D-Link D-View 8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28
-
Critical 9.8
D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts
D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts
-
Critical 9.8
D-Link DSL-G256DG firmware version vBZ_1.00.27 Authentication Bypass
D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.
-
Critical 9.9
DLINK - DSL-224 Post-auth RCE.
DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.