en
D-Link is a global networking equipment company that provides connectivity hardware and related network solutions. Its portfolio serves consumers, businesses, and industrial users through products such as wireless networking equipment, routers, switches, surveillance systems, storage devices, and network management services.
As of 10/05/2026, D-Link recorded 47 security vulnerabilities in the last 90 days across 41 products, including 31 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, DNS-340L had the most security vulnerabilities in the D-Link ecosystem, with 8 vulnerabilities—approximately 17.02% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-101081D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8400 | Published09/28/2026 | SeverityCritical |
CVE-2026-100740D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-895L | Published09/27/2026 | SeverityCritical |
CVE-2026-96891D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-825 | Published09/24/2026 | SeverityCritical |
CVE-2026-95675D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface | Exploitation statusPublic exploit | FixYes | Affected productDAP-1360 | Published09/22/2026 | SeverityCritical |
CVE-2026-94089D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-868L | Published09/20/2026 | SeverityCritical |
CVE-2026-94050D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure | Exploitation statusNot known exploited | FixYes | Affected productDIR-X1860Z | Published09/20/2026 | SeverityMedium |
CVE-2026-94036D-Link DIR-X1860/DIR-X1860Z routerd ubus access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-X1860 | Published09/20/2026 | SeverityHigh |
CVE-2026-93958D-Link R95 DHMAPI ssi system os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productR95 | Published09/20/2026 | SeverityCritical |
CVE-2026-91003D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8300 | Published09/15/2026 | SeverityCritical |
CVE-2026-91001D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8400 | Published09/15/2026 | SeverityCritical |
CVE-2026-90881D-Link DIR-882 CGI Binary dllog.cgi main information disclosure | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-882 | Published09/15/2026 | SeverityMedium |
CVE-2026-90880D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDSL-3782 | Published09/15/2026 | SeverityMedium |
CVE-2026-90706D-Link DWR-M921 formWsc os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M921 | Published09/14/2026 | SeverityMedium |
CVE-2026-90705D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M921 | Published09/14/2026 | SeverityMedium |
CVE-2026-90704D-Link DWR-M921 formDiskPartition system command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M921 | Published09/14/2026 | SeverityMedium |
CVE-2026-90703D-Link DWR-M921 formDiskCreateShare system os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M921 | Published09/14/2026 | SeverityCritical |
CVE-2026-90702D-Link DWR-M921 formDiskFormat system os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M921 | Published09/14/2026 | SeverityCritical |
CVE-2026-90699D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published09/14/2026 | SeverityCritical |
CVE-2026-90693D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-878 | Published09/14/2026 | SeverityCritical |
CVE-2026-90692D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-878 | Published09/14/2026 | SeverityCritical |
CVE-2026-90680D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-823G | Published09/14/2026 | SeverityCritical |
CVE-2026-86510D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822A | Published09/08/2026 | SeverityCritical |
CVE-2026-86509D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-895L | Published09/08/2026 | SeverityCritical |
CVE-2026-86297D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605 | Published09/07/2026 | SeverityCritical |
CVE-2026-86296D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822A | Published09/07/2026 | SeverityCritical |
CVE-2026-86295D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-895L | Published09/07/2026 | SeverityMedium |
CVE-2026-85224D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 ShareCenter | Published09/03/2026 | SeverityCritical |
CVE-2026-85223D-Link DNS-340L CGI dropbox.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published09/03/2026 | SeverityCritical |
CVE-2026-85222D-Link DNS-340L Add-On Center addon_center.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published09/03/2026 | SeverityCritical |
CVE-2026-82692D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published08/31/2026 | SeverityCritical |
CVE-2026-82691D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320L | Published08/31/2026 | SeverityCritical |
CVE-2026-82690D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-327L | Published08/31/2026 | SeverityCritical |
CVE-2026-82689D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320L | Published08/31/2026 | SeverityCritical |
CVE-2026-82688D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published08/31/2026 | SeverityCritical |
CVE-2026-82680D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write | Exploitation statusPublic exploit | FixNot confirmed | Affected productDSM-G600 | Published08/31/2026 | SeverityHigh |
CVE-2026-82595D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published08/30/2026 | SeverityMedium |
CVE-2026-82593D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow | Exploitation statusPublic exploit | FixYes | Affected productDIR-825M | Published08/30/2026 | SeverityCritical |
CVE-2026-82592D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published08/30/2026 | SeverityCritical |
CVE-2026-19893D-Link DIR-842 vsftpd vsftpd.conf default permission | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-842 | Published08/15/2026 | SeverityLow |
CVE-2026-16448D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published07/21/2026 | SeverityMedium |
CVE-2026-16447D-Link DNS-320 multi_uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16332D-Link DNS-320 multi_uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16331D-Link DNS-320 save_ajax.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16330D-Link DNS-320 uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16329D-Link DNS-320 uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16327D-Link DNS-320 upload.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/20/2026 | SeverityMedium |
CVE-2026-15270D-link DIR-823G Web boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-823G | Published07/09/2026 | SeverityHigh |
CVE-2026-13545D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published06/29/2026 | SeverityHigh |
CVE-2026-12174D-Link DCS-935L HTTP rhea snprintf format string | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published06/13/2026 | SeverityHigh |
CVE-2026-11555D-Link DGS-1100-08PD Web boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDGS-1100-08PD | Published06/08/2026 | SeverityMedium |
CVE-2026-11497D-Link DCS-5615 Boa Webserver boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-5615 | Published06/08/2026 | SeverityMedium |
CVE-2026-11492D-Link DIR-823G vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-823G | Published06/08/2026 | SeverityMedium |
CVE-2026-11341D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-11339D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-10878D-Link DWR-M920 formSmsManage sub_41C8E8 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-10270D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-7001 MINI | Published06/01/2026 | SeverityHigh |
CVE-2026-10206D-Link DI-8400 dbsrv.asp stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8400 | Published06/01/2026 | SeverityHigh |
CVE-2018-25358D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-601 | Published05/23/2026 | SeverityHigh |
CVE-2026-8346D-Link DIR-816 portForward command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8345D-Link DIR-816 singlePortForward sub_445E7C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8344D-Link DIR-816 formDMZ.cgi sub_445E7C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8273D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8272D-Link DNS-320 webfile_mgr.cgi chown os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8271D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8260D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published05/11/2026 | SeverityHigh |
CVE-2026-7857D-Link DI-8100 CGI user_group.asp sprintf buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7856D-Link DI-8100 Web Management url_member.asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7855D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7854D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityCritical |
CVE-2026-7853D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityCritical |
CVE-2026-7851D-Link DI-8100 yyxz.asp sprintf stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-42376D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-456U Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42375D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-600L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42374D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-600L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42373D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42372D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L Firmware | Published05/04/2026 | SeverityHigh |
CVE-2026-7554D-Link M60 httpd password recovery | Exploitation statusPublic exploit | FixNot confirmed | Affected productM60 | Published05/01/2026 | SeverityMedium |
CVE-2026-7289D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published04/28/2026 | SeverityHigh |
CVE-2026-7288D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published04/28/2026 | SeverityHigh |
CVE-2026-7248D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published04/28/2026 | SeverityCritical |
CVE-2026-7247D-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published04/28/2026 | SeverityHigh |
CVE-2026-7069D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825 | Published04/27/2026 | SeverityHigh |
CVE-2026-7068D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825 | Published04/26/2026 | SeverityHigh |
CVE-2026-7067D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822 | Published04/26/2026 | SeverityMedium |
CVE-2026-7027D-Link DSL-2740R Wireless Setup Section cross site scripting | Exploitation statusNot known exploited | FixNot confirmed | Affected productDSL-2740R | Published04/26/2026 | SeverityMedium |
CVE-2026-7026D-Link DGS-3420 System Information Settings cross site scripting | Exploitation statusNot known exploited | FixNot confirmed | Affected productDGS-3420 | Published04/26/2026 | SeverityMedium |
CVE-2026-6947D-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection Bypass | Exploitation statusNot known exploited | FixYes | Affected productDWM-222W | Published04/24/2026 | SeverityHigh |
CVE-2026-6014D-Link DIR-513 POST Request formAdvanceSetup buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-6013D-Link DIR-513 POST Request formSetRoute buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-6012D-Link DIR-513 POST Request formSetPassword buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-5984D-Link DIR-605L POST Request formSetLog buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5983D-Link DIR-605L POST Request formSetDDNS buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5982D-Link DIR-605L POST Request formAdvNetwork buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5981D-Link DIR-605L POST Request formAdvFirewall buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5980D-Link DIR-605L POST Request formSetMACFilter buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5979D-Link DIR-605L POST Request formVirtualServ buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5844D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-882 | Published04/09/2026 | SeverityHigh |
CVE-2026-5815D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-645 | Published04/08/2026 | SeverityHigh |
CVE-2026-5312D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published04/01/2026 | SeverityMedium |
CVE-2026-5311D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published04/01/2026 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
