D-Link vulnerabilities in CISA KEV
D-Link has 26 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 12th highest of any vendor. 2 were added in the last 12 months; 2 are linked to known ransomware use (7.7% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Multiple Routers, with 3 entries. Other frequently affected products: DCS-2530L and DCS-2670L Devices (2); DIR-859 Router (2).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor d-link --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
26
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-04-24
most recent entry
┌─ last 12 months
2
entries added
┌─ ransomware use
2 of 26
7.7% linked to ransomware
┌─ distinct products
21
affected products
$ awk -F, {print $1} /var/log/kev/d-link.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 2 | 0 |
| 2022 | 10 | 2 |
| 2023 | 2 | 0 |
| 2024 | 6 | 0 |
| 2025 | 5 | 0 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/d-link.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Multiple Routers 3 entries
- DCS-2530L and DCS-2670L Devices 2 entries
- DIR-859 Router 2 entries
- Multiple NAS Devices 2 entries
- DCS-930L Devices 1 entry
$ kev-due-dates --vendor d-link
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ D-Link
21 days (range 14 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/d-link.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (25 of 26 have at least one CWE).
$ grep -ril 'D-Link' /var/log/news | head -5
Our reporting that names D-Link or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./d-link.kev · 26 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-29635
DIR-823X
D-Link DIR-823X Command Injection Vulnerability
due 2026-05-08 · CWE-77
$ cat CVE-2025-29635.txt
Description. D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2022-37055
Routers
D-Link Routers Buffer Overflow Vulnerability
due 2025-12-29 · CWE-120
$ cat CVE-2022-37055.txt
Description. D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2020-25078
DCS-2530L and DCS-2670L Devices
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
due 2025-08-26
$ cat CVE-2020-25078.txt
Description. D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2020-25079
DCS-2530L and DCS-2670L Devices
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
due 2025-08-26 · CWE-77
$ cat CVE-2020-25079.txt
Description. D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2022-40799
DNR-322L
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
due 2025-08-26 · CWE-494
$ cat CVE-2022-40799.txt
Description. D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-0769
DIR-859 Router
D-Link DIR-859 Router Path Traversal Vulnerability
due 2025-07-16 · CWE-22
$ cat CVE-2024-0769.txt
Description. D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-25280
DIR-820 Router
D-Link DIR-820 Router OS Command Injection Vulnerability
due 2024-10-21 · CWE-78
$ cat CVE-2023-25280.txt
Description. D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Required action. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CVE-2014-100005
DIR-600 Router
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
due 2024-06-06 · CWE-352
$ cat CVE-2014-100005.txt
Description. D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.
Required action. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CVE-2021-40655
DIR-605 Router
D-Link DIR-605 Router Information Disclosure Vulnerability
due 2024-06-06 · CWE-863
$ cat CVE-2021-40655.txt
Description. D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
Required action. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CVE-2024-3272
Multiple NAS Devices
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
due 2024-05-02 · CWE-798
$ cat CVE-2024-3272.txt
Description. D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
Required action. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CVE-2024-3273
Multiple NAS Devices
D-Link Multiple NAS Devices Command Injection Vulnerability
due 2024-05-02 · CWE-77
$ cat CVE-2024-3273.txt
Description. D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Required action. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CVE-2016-20017
DSL-2750B Devices
D-Link DSL-2750B Devices Command Injection Vulnerability
due 2024-01-29 · CWE-77
$ cat CVE-2016-20017.txt
Description. D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2019-17621
DIR-859 Router
D-Link DIR-859 Router Command Execution Vulnerability
due 2023-07-20 · CWE-78
$ cat CVE-2019-17621.txt
Description. D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2019-20500
DWL-2600AP Access Point
D-Link DWL-2600AP Access Point Command Injection Vulnerability
due 2023-07-20 · CWE-78
$ cat CVE-2019-20500.txt
Description. D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2011-4723
DIR-300 Router
D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
due 2022-09-29 · CWE-310
$ cat CVE-2011-4723.txt
Description. The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2018-6530
Multiple Routers [RANSOMWARE]
D-Link Multiple Routers OS Command Injection Vulnerability
due 2022-09-29 · CWE-78
$ cat CVE-2018-6530.txt
Description. Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
Required action. The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
- CVE-2022-26258
DIR-820L
D-Link DIR-820L Remote Code Execution Vulnerability
due 2022-09-29 · CWE-78
$ cat CVE-2022-26258.txt
Description. D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2019-16057
DNS-320 Storage Device [RANSOMWARE]
D-Link DNS-320 Remote Code Execution Vulnerability
due 2022-05-06 · CWE-78
$ cat CVE-2019-16057.txt
Description. The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2021-45382
Multiple Routers
D-Link Multiple Routers Remote Code Execution Vulnerability
due 2022-04-25 · CWE-78
$ cat CVE-2021-45382.txt
Description. A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2013-5223
DSL-2760U
D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
due 2022-04-15 · CWE-79
$ cat CVE-2013-5223.txt
Description. A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
Required action. Apply updates per vendor instructions.
- CVE-2016-11021
DCS-930L Devices
D-Link DCS-930L Devices OS Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2016-11021.txt
Description. setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2019-16920
Multiple Routers
D-Link Multiple Routers Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2019-16920.txt
Description. Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2020-9377
DIR-610 Devices
D-Link DIR-610 Devices Remote Command Execution
due 2022-04-15 · CWE-78
$ cat CVE-2020-9377.txt
Description. D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-2051
DIR-645 Router
D-Link DIR-645 Router Remote Code Execution Vulnerability
due 2022-08-10 · CWE-77
$ cat CVE-2015-2051.txt
Description. D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2020-25506
DNS-320 Device
D-Link DNS-320 Device Command Injection Vulnerability
due 2022-05-03 · CWE-78
$ cat CVE-2020-25506.txt
Description. D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-29557
DIR-825 R1 Devices
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
due 2022-05-03 · CWE-119
$ cat CVE-2020-29557.txt
Description. D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.
Required action. Apply updates per vendor instructions.