D Link vulnerabilities, page 5
926 vulnerabilities
Known vulnerabilities in D Link products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 335 products.
HighCVE-2007-3347d-link · dph-540 +1 mored-link dph-540The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.EPSS1.25%HighCVE-2007-3348d-link · dph-540 +1 mored-link dph-540The D-Link DPH-540/DPH-541 phone allows remote attackers to cause a denial of service (device outage) via a malformed SDP header in a SIP INVITE message.EPSS1.67%HighCVE-2016-1559d-link · dap-1353_h\/w_b1_firmware +2 mored-link dap-1353_h\/w_b1_firmwareD-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless passwords and administrative usernames and passwords over SNMP.EPSS3.30%CriticalCVE-2016-5681d-link · dir-817l\(w\)_firmware +9 mored-link dir-817l\(w\)_firmwareStack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.EPSS11.93%CriticalCVE-2016-10405d-link · dir-600l_firmwared-link dir-600l_firmwareSession fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.EPSS1.93%HighCVE-2025-2548d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formSetDomainFilter access controlA vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/formSetDomainFilter. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.03%CriticalCVE-2025-2620d-link · dap-1620 +1 moreD-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflowA vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS8.85%CriticalCVE-2025-2618d-link · dap-1620 +1 moreD-Link DAP-1620 Path api set_ws_action heap-based overflowA vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS2.06%CriticalCVE-2025-2359d-link · dir-823g_firmware +1 moreD-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorizationA vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the component DDNS Service. The manipulation of the argument SOAPAction leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS15.40%MediumCVE-2025-2547d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formAdvNetwork access controlA vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.79%HighCVE-2025-2717d-link · dir-823x +1 moreD-Link DIR-823X HTTP POST Request diag_nslookup sub_41710C os command injectionA vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS4.62%CriticalCVE-2025-2619d-link · dap-1620 +1 moreD-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflowA vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS2.06%MediumCVE-2025-2546d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access controlA vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formAdvFirewall of the component Firewall Service. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS10.76%MediumCVE-2025-2550d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L DDNS Service formSetDDNS access controlA vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/formSetDDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.79%CriticalCVE-2025-2360d-link · dir-823g_firmware +1 moreD-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorizationA vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS4.20%MediumCVE-2025-2551d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formSetPortTr access controlA vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.79%CriticalCVE-2025-2621d-link · dap-1620 +1 moreD-Link DAP-1620 storage check_dws_cookie stack-based overflowA vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipulation of the argument uid leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS2.13%MediumCVE-2025-2553d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formVirtualServ access controlA vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.27%HighCVE-2025-2549d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formSetPassword access controlA vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/formSetPassword. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.03%MediumCVE-2025-2552d-link · dir-605l_firmware +3 moreD-Link DIR-618/DIR-605L formTcpipSetup access controlA vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.EPSS0.79%