Filtered by vendor D-link
Subscriptions
Total
684 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-26237 | 1 D-link | 1 Di-7001 Mini | 2026-08-28 | 8.1 High |
| D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands. | ||||
| CVE-2026-71957 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-17 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash. | ||||
| CVE-2026-71952 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-17 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges. | ||||
| CVE-2026-71947 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-17 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges. | ||||
| CVE-2026-19893 | 1 D-link | 1 Dir-842 | 2026-08-15 | 3.1 Low |
| A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. | ||||
| CVE-2026-71958 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash. | ||||
| CVE-2026-71956 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges. | ||||
| CVE-2026-71955 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71954 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71953 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges. | ||||
| CVE-2026-71951 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges. | ||||
| CVE-2026-71950 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges. | ||||
| CVE-2026-71949 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71948 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges. | ||||
| CVE-2026-71946 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges. | ||||
| CVE-2026-71945 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges. | ||||
| CVE-2026-71944 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges. | ||||
| CVE-2026-16332 | 1 D-link | 1 Dns-320 | 2026-07-23 | 7.3 High |
| A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. | ||||
| CVE-2026-16331 | 1 D-link | 1 Dns-320 | 2026-07-22 | 7.3 High |
| A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-16447 | 1 D-link | 1 Dns-320 | 2026-07-22 | 7.3 High |
| A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. | ||||