{"meta":{"title":"KEV entries: D-Link","description":"All KEV entries for vendor D-Link.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":26,"vendor":"D-Link","entries":26,"shareOfCatalogPercent":1.5,"ransomwareKnown":2,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-04-24","rank":11},"data":[{"cveID":"CVE-2025-29635","vendorProject":"D-Link","product":"DIR-823X","vulnerabilityName":"D-Link DIR-823X Command Injection Vulnerability","dateAdded":"2026-04-24","dueDate":"2026-05-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29635","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-29635"},{"cveID":"CVE-2022-37055","vendorProject":"D-Link","product":"Routers","vulnerabilityName":"D-Link Routers Buffer Overflow Vulnerability","dateAdded":"2025-12-08","dueDate":"2025-12-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308 ; https://nvd.nist.gov/vuln/detail/CVE-2022-37055","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2022-37055"},{"cveID":"CVE-2022-40799","vendorProject":"D-Link","product":"DNR-322L","vulnerabilityName":"D-Link DNR-322L Download of Code Without Integrity Check Vulnerability","dateAdded":"2025-08-05","dueDate":"2025-08-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-494"],"shortDescription":"D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.dlink.com/uk/en/products/dnr-322l-cloud-network-video-recorder ; https://nvd.nist.gov/vuln/detail/CVE-2022-40799","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2022-40799"},{"cveID":"CVE-2020-25079","vendorProject":"D-Link","product":"DCS-2530L and DCS-2670L Devices","vulnerabilityName":"D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability","dateAdded":"2025-08-05","dueDate":"2025-08-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.dlink.com/productinfo.aspx?m=DCS-2530L ; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 ; https://nvd.nist.gov/vuln/detail/CVE-2020-25079","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-25079"},{"cveID":"CVE-2020-25078","vendorProject":"D-Link","product":"DCS-2530L and DCS-2670L Devices","vulnerabilityName":"D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability","dateAdded":"2025-08-05","dueDate":"2025-08-26","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.dlink.com/productinfo.aspx?m=DCS-2530L ; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 ; https://nvd.nist.gov/vuln/detail/CVE-2020-25078","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-25078"},{"cveID":"CVE-2024-0769","vendorProject":"D-Link","product":"DIR-859 Router","vulnerabilityName":" D-Link DIR-859 Router Path Traversal Vulnerability","dateAdded":"2025-06-25","dueDate":"2025-07-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0769","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-0769"},{"cveID":"CVE-2023-25280","vendorProject":"D-Link","product":"DIR-820 Router","vulnerabilityName":"D-Link DIR-820 Router OS Command Injection Vulnerability","dateAdded":"2024-09-30","dueDate":"2024-10-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358 ; https://nvd.nist.gov/vuln/detail/CVE-2023-25280","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-25280"},{"cveID":"CVE-2021-40655","vendorProject":"D-Link","product":"DIR-605 Router","vulnerabilityName":"D-Link DIR-605 Router Information Disclosure Vulnerability","dateAdded":"2024-05-16","dueDate":"2024-06-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. ","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5; https://nvd.nist.gov/vuln/detail/CVE-2021-40655","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2021-40655"},{"cveID":"CVE-2014-100005","vendorProject":"D-Link","product":"DIR-600 Router","vulnerabilityName":"D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability","dateAdded":"2024-05-16","dueDate":"2024-06-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-352"],"shortDescription":"D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283; https://nvd.nist.gov/vuln/detail/CVE-2014-100005","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2014-100005"},{"cveID":"CVE-2024-3273","vendorProject":"D-Link","product":"Multiple NAS Devices","vulnerabilityName":"D-Link Multiple NAS Devices Command Injection Vulnerability","dateAdded":"2024-04-11","dueDate":"2024-05-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-3273"},{"cveID":"CVE-2024-3272","vendorProject":"D-Link","product":"Multiple NAS Devices","vulnerabilityName":"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability","dateAdded":"2024-04-11","dueDate":"2024-05-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-798"],"shortDescription":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3272","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-3272"},{"cveID":"CVE-2016-20017","vendorProject":"D-Link","product":"DSL-2750B Devices","vulnerabilityName":"D-Link DSL-2750B Devices Command Injection Vulnerability","dateAdded":"2024-01-08","dueDate":"2024-01-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088; https://nvd.nist.gov/vuln/detail/CVE-2016-20017","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2016-20017"},{"cveID":"CVE-2019-20500","vendorProject":"D-Link","product":"DWL-2600AP Access Point","vulnerabilityName":"D-Link DWL-2600AP Access Point Command Injection Vulnerability","dateAdded":"2023-06-29","dueDate":"2023-07-20","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2019-20500"},{"cveID":"CVE-2019-17621","vendorProject":"D-Link","product":"DIR-859 Router","vulnerabilityName":"D-Link DIR-859 Router Command Execution Vulnerability","dateAdded":"2023-06-29","dueDate":"2023-07-20","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2019-17621"},{"cveID":"CVE-2022-26258","vendorProject":"D-Link","product":"DIR-820L","vulnerabilityName":"D-Link DIR-820L Remote Code Execution Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10295;  https://nvd.nist.gov/vuln/detail/CVE-2022-26258","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26258"},{"cveID":"CVE-2018-6530","vendorProject":"D-Link","product":"Multiple Routers","vulnerabilityName":"D-Link Multiple Routers OS Command Injection Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.","requiredAction":"The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105; https://nvd.nist.gov/vuln/detail/CVE-2018-6530","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-6530"},{"cveID":"CVE-2011-4723","vendorProject":"D-Link","product":"DIR-300 Router","vulnerabilityName":"D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-310"],"shortDescription":"The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://www.dlink.com/uk/en/support/product/dir-300-wireless-g-router; https://nvd.nist.gov/vuln/detail/CVE-2011-4723","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2011-4723"},{"cveID":"CVE-2019-16057","vendorProject":"D-Link","product":"DNS-320 Storage Device","vulnerabilityName":"D-Link DNS-320 Remote Code Execution Vulnerability","dateAdded":"2022-04-15","dueDate":"2022-05-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-16057","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-16057"},{"cveID":"CVE-2021-45382","vendorProject":"D-Link","product":"Multiple Routers","vulnerabilityName":"D-Link Multiple Routers Remote Code Execution Vulnerability","dateAdded":"2022-04-04","dueDate":"2022-04-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-45382","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-45382"},{"cveID":"CVE-2020-9377","vendorProject":"D-Link","product":"DIR-610 Devices","vulnerabilityName":"D-Link DIR-610 Devices Remote Command Execution","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-9377","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-9377"},{"cveID":"CVE-2019-16920","vendorProject":"D-Link","product":"Multiple Routers","vulnerabilityName":"D-Link Multiple Routers Command Injection Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-16920","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-16920"},{"cveID":"CVE-2016-11021","vendorProject":"D-Link","product":"DCS-930L Devices","vulnerabilityName":"D-Link DCS-930L Devices OS Command Injection Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-11021","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-11021"},{"cveID":"CVE-2013-5223","vendorProject":"D-Link","product":"DSL-2760U","vulnerabilityName":"D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-5223","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-5223"},{"cveID":"CVE-2015-2051","vendorProject":"D-Link","product":"DIR-645 Router","vulnerabilityName":"D-Link DIR-645 Router Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2051","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2051"},{"cveID":"CVE-2020-29557","vendorProject":"D-Link","product":"DIR-825 R1 Devices","vulnerabilityName":"D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-29557","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-29557"},{"cveID":"CVE-2020-25506","vendorProject":"D-Link","product":"DNS-320 Device","vulnerabilityName":"D-Link DNS-320 Device Command Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-25506","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-25506"}]}