en
D-Link is a global networking equipment company that provides connectivity hardware and related network solutions. Its portfolio serves consumers, businesses, and industrial users through products such as wireless networking equipment, routers, switches, surveillance systems, storage devices, and network management services.
As of 09/13/2026, D-Link recorded 27 security vulnerabilities in the last 90 days across 29 products, including 17 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, DNS-340L had the most security vulnerabilities in the D-Link ecosystem, with 8 vulnerabilities—approximately 29.63% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-86510D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822A | Published09/08/2026 | SeverityCritical |
CVE-2026-86509D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-895L | Published09/08/2026 | SeverityCritical |
CVE-2026-86297D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605 | Published09/07/2026 | SeverityCritical |
CVE-2026-86296D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822A | Published09/07/2026 | SeverityCritical |
CVE-2026-86295D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-895L | Published09/07/2026 | SeverityMedium |
CVE-2026-85224D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 ShareCenter | Published09/03/2026 | SeverityCritical |
CVE-2026-85223D-Link DNS-340L CGI dropbox.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published09/03/2026 | SeverityCritical |
CVE-2026-85222D-Link DNS-340L Add-On Center addon_center.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published09/03/2026 | SeverityCritical |
CVE-2026-82692D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published08/31/2026 | SeverityCritical |
CVE-2026-82691D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320L | Published08/31/2026 | SeverityCritical |
CVE-2026-82690D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-327L | Published08/31/2026 | SeverityCritical |
CVE-2026-82689D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320L | Published08/31/2026 | SeverityCritical |
CVE-2026-82688D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-340L | Published08/31/2026 | SeverityCritical |
CVE-2026-82680D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write | Exploitation statusPublic exploit | FixNot confirmed | Affected productDSM-G600 | Published08/31/2026 | SeverityHigh |
CVE-2026-82595D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published08/30/2026 | SeverityMedium |
CVE-2026-82593D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow | Exploitation statusPublic exploit | FixYes | Affected productDIR-825M | Published08/30/2026 | SeverityCritical |
CVE-2026-82592D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published08/30/2026 | SeverityCritical |
CVE-2026-19893D-Link DIR-842 vsftpd vsftpd.conf default permission | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-842 | Published08/15/2026 | SeverityLow |
CVE-2026-16448D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published07/21/2026 | SeverityMedium |
CVE-2026-16447D-Link DNS-320 multi_uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16332D-Link DNS-320 multi_uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16331D-Link DNS-320 save_ajax.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16330D-Link DNS-320 uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16329D-Link DNS-320 uploadify.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/21/2026 | SeverityMedium |
CVE-2026-16327D-Link DNS-320 upload.php unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published07/20/2026 | SeverityMedium |
CVE-2026-15270D-link DIR-823G Web boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-823G | Published07/09/2026 | SeverityHigh |
CVE-2026-13545D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published06/29/2026 | SeverityHigh |
CVE-2026-12174D-Link DCS-935L HTTP rhea snprintf format string | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published06/13/2026 | SeverityHigh |
CVE-2026-11555D-Link DGS-1100-08PD Web boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDGS-1100-08PD | Published06/08/2026 | SeverityMedium |
CVE-2026-11497D-Link DCS-5615 Boa Webserver boa.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-5615 | Published06/08/2026 | SeverityMedium |
CVE-2026-11492D-Link DIR-823G vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-823G | Published06/08/2026 | SeverityMedium |
CVE-2026-11341D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-11339D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-10878D-Link DWR-M920 formSmsManage sub_41C8E8 command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDWR-M920 | Published06/05/2026 | SeverityMedium |
CVE-2026-10270D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-7001 MINI | Published06/01/2026 | SeverityHigh |
CVE-2026-10206D-Link DI-8400 dbsrv.asp stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8400 | Published06/01/2026 | SeverityHigh |
CVE-2018-25358D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-601 | Published05/23/2026 | SeverityHigh |
CVE-2026-8346D-Link DIR-816 portForward command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8345D-Link DIR-816 singlePortForward sub_445E7C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8344D-Link DIR-816 formDMZ.cgi sub_445E7C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-816 | Published05/11/2026 | SeverityMedium |
CVE-2026-8273D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8272D-Link DNS-320 webfile_mgr.cgi chown os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8271D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-320 | Published05/11/2026 | SeverityMedium |
CVE-2026-8260D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDCS-935L | Published05/11/2026 | SeverityHigh |
CVE-2026-7857D-Link DI-8100 CGI user_group.asp sprintf buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7856D-Link DI-8100 Web Management url_member.asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7855D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-7854D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityCritical |
CVE-2026-7853D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityCritical |
CVE-2026-7851D-Link DI-8100 yyxz.asp sprintf stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published05/05/2026 | SeverityHigh |
CVE-2026-42376D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-456U Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42375D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-600L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42374D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-600L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42373D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L Firmware | Published05/04/2026 | SeverityCritical |
CVE-2026-42372D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L Firmware | Published05/04/2026 | SeverityHigh |
CVE-2026-7554D-Link M60 httpd password recovery | Exploitation statusPublic exploit | FixNot confirmed | Affected productM60 | Published05/01/2026 | SeverityMedium |
CVE-2026-7289D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published04/28/2026 | SeverityHigh |
CVE-2026-7288D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825M | Published04/28/2026 | SeverityHigh |
CVE-2026-7248D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published04/28/2026 | SeverityCritical |
CVE-2026-7247D-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDI-8100 | Published04/28/2026 | SeverityHigh |
CVE-2026-7069D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825 | Published04/27/2026 | SeverityHigh |
CVE-2026-7068D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-825 | Published04/26/2026 | SeverityHigh |
CVE-2026-7067D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-822 | Published04/26/2026 | SeverityMedium |
CVE-2026-7027D-Link DSL-2740R Wireless Setup Section cross site scripting | Exploitation statusNot known exploited | FixNot confirmed | Affected productDSL-2740R | Published04/26/2026 | SeverityMedium |
CVE-2026-7026D-Link DGS-3420 System Information Settings cross site scripting | Exploitation statusNot known exploited | FixNot confirmed | Affected productDGS-3420 | Published04/26/2026 | SeverityMedium |
CVE-2026-6947D-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection Bypass | Exploitation statusNot known exploited | FixYes | Affected productDWM-222W | Published04/24/2026 | SeverityHigh |
CVE-2026-6014D-Link DIR-513 POST Request formAdvanceSetup buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-6013D-Link DIR-513 POST Request formSetRoute buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-6012D-Link DIR-513 POST Request formSetPassword buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published04/10/2026 | SeverityHigh |
CVE-2026-5984D-Link DIR-605L POST Request formSetLog buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5983D-Link DIR-605L POST Request formSetDDNS buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5982D-Link DIR-605L POST Request formAdvNetwork buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5981D-Link DIR-605L POST Request formAdvFirewall buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5980D-Link DIR-605L POST Request formSetMACFilter buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5979D-Link DIR-605L POST Request formVirtualServ buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-605L | Published04/09/2026 | SeverityHigh |
CVE-2026-5844D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-882 | Published04/09/2026 | SeverityHigh |
CVE-2026-5815D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-645 | Published04/08/2026 | SeverityHigh |
CVE-2026-5312D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published04/01/2026 | SeverityMedium |
CVE-2026-5311D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published04/01/2026 | SeverityMedium |
CVE-2026-5215D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/31/2026 | SeverityMedium |
CVE-2026-5214D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/31/2026 | SeverityHigh |
CVE-2026-5213D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/31/2026 | SeverityHigh |
CVE-2026-5212D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/31/2026 | SeverityHigh |
CVE-2026-5211D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/31/2026 | SeverityHigh |
CVE-2026-5024D-Link DIR-513 formSetEmail stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published03/29/2026 | SeverityHigh |
CVE-2026-4627D-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injection | Exploitation statusNot known exploited | FixNot confirmed | Affected productDIR-825 | Published03/24/2026 | SeverityHigh |
CVE-2026-4555D-Link DIR-513 boa formEasySetTimezone memory corruption | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published03/22/2026 | SeverityHigh |
CVE-2026-4529D-Link DHP-1320 SOAP redirect_count_down_page stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDHP-1320 | Published03/21/2026 | SeverityHigh |
CVE-2026-4499D-Link DIR-820LW SSDP ssdpcgi_main os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-820LW | Published03/20/2026 | SeverityMedium |
CVE-2026-4486D-Link DIR-513 Web Service formEasySetPassword stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published03/20/2026 | SeverityHigh |
CVE-2026-4465D-Link DIR-513 formSysCmd os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDIR-513 | Published03/20/2026 | SeverityMedium |
CVE-2026-4214D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityHigh |
CVE-2026-4213D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityHigh |
CVE-2026-4212D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityHigh |
CVE-2026-4211D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityHigh |
CVE-2026-4210D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityMedium |
CVE-2026-4209D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityMedium |
CVE-2026-4207D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityMedium |
CVE-2026-4206D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityMedium |
CVE-2026-4205D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productDNS-120 | Published03/16/2026 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
