Vendor
D-Link
952 known vulnerabilities in products by D-Link, 3 of them actively exploited (CISA KEV).
Key figures
952
Vulnerabilities
3
Actively exploited (KEV)
0
Used by ransomware
258
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2024-3272 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials In CISA KEV | 9.8 | |
| Critical | CVE-2024-3273 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection In CISA KEV | 7.3 | |
| Critical | CVE-2024-0769 | D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal In CISA KEV | 5.3 | |
| Critical | CVE-2026-110536 | D-Link DIR-868L HNAP CGI cgibin system os command injection | 10.0 | |
| Critical | CVE-2026-90699 | D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection | 9.9 | |
| Critical | CVE-2026-90703 | D-Link DWR-M921 formDiskCreateShare system os command injection | 9.1 | |
| Critical | CVE-2026-90702 | D-Link DWR-M921 formDiskFormat system os command injection | 9.1 | |
| Critical | CVE-2026-85223 | D-Link DNS-340L CGI dropbox.cgi os command injection | 9.9 | |
| Critical | CVE-2026-82692 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | 9.9 | |
| Critical | CVE-2026-82689 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection | 9.9 | |
| Critical | CVE-2026-85222 | D-Link DNS-340L Add-On Center addon_center.cgi os command injection | 9.1 | |
| Critical | CVE-2026-85224 | D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | 9.1 | |
| Critical | CVE-2026-82691 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | 9.1 | |
| Critical | CVE-2026-82690 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | 9.1 | |
| Critical | CVE-2026-82688 | D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection | 9.1 | |
| Critical | CVE-2013-10069 | D-Link Devices Unauthenticated RCE | 9.8 | |
| Critical | CVE-2026-93958 | D-Link R95 DHMAPI ssi system os command injection | 9.1 | |
| Critical | CVE-2025-7206 | D-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflow | 9.8 | |
| Critical | CVE-2026-3485 | D-Link DIR-868L SSDP Service sub_1BF84 os command injection | 9.8 | |
| Critical | CVE-2013-10048 | D-Link Devices command.php Unauthenticated RCE | 9.8 | |
| Critical | CVE-2026-71953 | D-Link DWR-M961 Command Injection via /boafrm/formNtp | 9.8 | |
| Critical | CVE-2026-71949 | D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup | 9.8 | |
| Critical | CVE-2026-71947 | D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun | 9.8 | |
| Critical | CVE-2026-71946 | D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun | 9.8 | |
| Critical | CVE-2026-71945 | D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom | 9.8 |
News
- D-Link warns of max severity zero-day bug in DIR-822A routersbleepingcomputer,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 19sans-atrisk,