D-Link vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 202115
3. 202112
4. 2024125
5. 2025210
6. 2025217
7. 202532
8. 20251
9. 20254
10. 20251
11. 2026206
12. 20263

Known exploitedNewest addition to KEV first

• CVE-2024-0769

  D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

  D-Link · DIR-859

  ExploitedMedium5.3
• CVE-2024-3273

  D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

  D-Link · DNS-320L

  ExploitedHigh7.3
• CVE-2024-3272

  D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

  D-Link · DNS-320L

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-120189

  D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow

  D-Link · DIR-505

  Critical10.0
• CVE-2026-118579

  D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

  D-Link · DIR-505

  Critical9.3
• CVE-2026-113736

  D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password

  D-Link · DHP-W610AV

  Critical9.3
• CVE-2026-113735

  D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials

  D-Link · DCS-6501LH

  Medium6.3
• CVE-2026-112146

  D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials

  D-Link · E15

  Medium5.3
• CVE-2026-110536

  D-Link DIR-868L HNAP CGI cgibin system os command injection

  D-Link · DIR-868L

  Critical10.0
• CVE-2026-108971

  D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification

  D-Link · DCS-930L

  Critical9.4
• CVE-2026-101081

  D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

  D-Link · DI-8400

  Critical9.4
• CVE-2026-100740

  D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

  D-Link · DIR-895L

  Critical9.4
• CVE-2026-96891

  D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write

  D-Link · DIR-825

  Critical9.3