CVE-2018-6530VulnerabilityPublished 09/08/2022Updated 10/24/2026
CVE-2018-6530: D-Link Multiple Routers OS Command Injection Vulnerability
Affects D-Link Multiple RoutersSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/08/2022
- KEV deadline
- 09/29/2022
- Ransomware
- Used in ransomware campaigns
- EPSS
- 96.7% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
Description
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.