pwn.watch: D-Link incident updates

[critical] D-Link Routers: Routers Buffer Overflow Vulnerability

Mon, 08 Dec 2025 00:00:00 GMT

D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-12-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-08: CISA added CVE-2022-37055 to the KEV catalog (due 2025-12-29).

CVEs: CVE-2022-37055

[high] D-Link DCS-2530L and DCS-2670L Devices: 2 exploited vulnerabilities (CVE-2020-25078, CVE-2020-25079)

Tue, 05 Aug 2025 00:00:00 GMT

CVE-2020-25078: D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2020-25079: D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-08-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-05: CISA added CVE-2020-25078 to the KEV catalog (due 2025-08-26).
2025-08-05: CISA added CVE-2020-25079 to the KEV catalog (due 2025-08-26).

CVEs: CVE-2020-25078, CVE-2020-25079

[high] D-Link DNR-322L: DNR-322L Download of Code Without Integrity Check Vulnerability

Tue, 05 Aug 2025 00:00:00 GMT

D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-08-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-05: CISA added CVE-2022-40799 to the KEV catalog (due 2025-08-26).

CVEs: CVE-2022-40799

[medium] D-Link DIR-859 Router: D-Link DIR-859 Router Path Traversal Vulnerability

Wed, 25 Jun 2025 00:00:00 GMT

D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Added to CISA KEV on 2025-06-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-25: CISA added CVE-2024-0769 to the KEV catalog (due 2025-07-16).

CVEs: CVE-2024-0769

[critical] D-Link DIR-820 Router OS Command Injection

Mon, 30 Sep 2024 00:00:00 GMT

D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Added to the CISA KEV catalog on 2024-09-30. CVE-2023-25280 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-09-30: CISA added CVE-2023-25280 to the KEV catalog (federal deadline 2024-10-21) (source)

CVEs: CVE-2023-25280

[high] D-Link DIR-600 Router Cross-Site Request Forgery (CSRF)

Thu, 16 May 2024 00:00:00 GMT

D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session. Added to the CISA KEV catalog on 2024-05-16. CVE-2014-100005 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-05-16: CISA added CVE-2014-100005 to the KEV catalog (federal deadline 2024-06-06) (source)

CVEs: CVE-2014-100005

[high] D-Link DIR-605 Router Information Disclosure

Thu, 16 May 2024 00:00:00 GMT

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Added to the CISA KEV catalog on 2024-05-16. CVE-2021-40655 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-05-16: CISA added CVE-2021-40655 to the KEV catalog (federal deadline 2024-06-06) (source)

CVEs: CVE-2021-40655

[critical] D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities

Thu, 11 Apr 2024 00:00:00 GMT

CVE-2024-3272: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. CVE-2024-3273: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Added to the CISA KEV catalog on 2024-04-11.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-04-11: CISA added CVE-2024-3272 to the KEV catalog (federal deadline 2024-05-02) (source)
2024-04-11: CISA added CVE-2024-3273 to the KEV catalog (federal deadline 2024-05-02) (source)
2024-04-04: CVE-2024-3272 published (source)

CVEs: CVE-2024-3272, CVE-2024-3273

[critical] D-Link DSL-2750B Devices Command Injection

Mon, 08 Jan 2024 00:00:00 GMT

D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Added to the CISA KEV catalog on 2024-01-08. CVE-2016-20017 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-08: CISA added CVE-2016-20017 to the KEV catalog (federal deadline 2024-01-29) (source)

CVEs: CVE-2016-20017