Threat database

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

CVE-2026-90692 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-878 router, specifically in version 120B05. The flaw exists in the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. An attacker can remotely exploit this vulnerability by manipulating the IPv6Address or Hostname argument, potentially leading to arbitrary code execution or denial of service.

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. The attack can be launched remotely.

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname  leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-86295 is a command injection vulnerability in the D-Link DIR-895L router, specifically in the sendACK function of the udhcpcd component. The vulnerability arises from improper handling of the Hostname argument, allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A critical OS command injection vulnerability exists in D-Link DNS-340L and DNS-345 devices up to 20260717. The flaw is located in the /cgi-bin/iscsi_mgr.cgi file and involves manipulation of the alias, username, password, or volume_location parameters. This vulnerability can be exploited remotely without user interaction. Public exploit code is available. No official patch or remediation guidance has been confirmed yet.

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A critical OS command injection vulnerability exists in D-Link DNS-327L and DNS-340L devices up to version 20260717. The flaw is in the /cgi-bin/ve_mgr.cgi file where manipulation of the f_dev argument allows remote attackers to execute arbitrary OS commands. Exploit code has been published, but no confirmed in-the-wild exploitation is reported. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-82689 is a critical OS command injection vulnerability affecting D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices up to the 20260717 firmware version. The flaw exists in the /cgi-bin/isomount_mgr.cgi component's ISO Image Handler, where manipulation of the upIsoRootPath argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. Exploit code is publicly available, but no confirmed active exploitation in the wild has been reported. No official patch or remediation guidance has been provided by the vendor as of the published date.