A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.
This issue was fixed in version 1.00B16CP.
CVE-2026-8346 is a command injection vulnerability in the D-Link DIR-816 router firmware version 1.10CNB05_R1B011D88210. The flaw exists in the portForward function, where manipulation of the ip_address argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.
CVE-2026-8345 is a command injection vulnerability in the D-Link DIR-816 router firmware version 1.10CNB05_R1B011D88210. The issue exists in the /goform/singlePortForward endpoint, specifically in the function sub_445E7C, where manipulation of the ip_address argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands on the affected device without user interaction. The exploit has been publicly disclosed but there are no known exploits in the wild at this time. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.3. No official patch or remediation guidance has been provided by the vendor yet.
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-8273 is a medium severity vulnerability in D-Link DNS-320 version 2.06B01. It involves an OS command injection weakness in several CGI functions within the /cgi-bin/system_mgr.cgi file. This vulnerability can be exploited remotely without user interaction but requires high privileges. No official patch or remediation guidance has been provided yet.
A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2026-8271 is an OS command injection vulnerability in the D-Link DNS-320 device running firmware version 2.06B01. The issue exists in multiple functions within the /cgi-bin/network_mgr.cgi file, allowing remote attackers to inject OS commands. The vulnerability has a medium severity rating with a CVSS score of 5.1. Exploits are publicly available, but no known active exploitation in the wild has been reported. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-8260 is a high-severity buffer overflow vulnerability in the D-Link DCS-935L device firmware version 1.10.01. The flaw exists in the SetDeviceSettings function within the HNAP Service component, specifically in the handling of the AdminPassword argument. This vulnerability can be exploited remotely without user interaction or privileges. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management Interface. Executing a manipulation of the argument Name can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
CVE-2026-7854 is a critical buffer overflow vulnerability in the D-Link DI-8100 router firmware version 16.07.26A1. It affects the url_rule_asp function in the /url_rule.asp file, specifically in the POST parameter handler. This vulnerability can be exploited remotely without authentication and does not require user interaction. Although the exploit has been publicly disclosed, there are no confirmed reports of active exploitation in the wild. No official patch or remediation guidance is currently available from the vendor.
A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the argument enable/time causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-7851 is a high-severity stack-based buffer overflow vulnerability in the D-Link DI-8100 router firmware version 16.07.26A1. The flaw exists in the sprintf function within the yyxz.asp file, where improper handling of the ID argument allows remote attackers to trigger a buffer overflow. Exploitation can be performed remotely without user interaction and requires high privileges. Although an exploit is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01_dlob_dir456U" read from /etc/config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
The D-Link DIR-600L Hardware Revision A1 firmware contains a hardcoded telnet backdoor with static credentials. This backdoor launches a telnet daemon at boot, allowing anyone on the local network to authenticate using the fixed username "Alphanetworks" and password "wrgn35_dlwbr_dir600l". Successful login grants root shell access, providing full administrative control. The device is End-of-Life and will not receive patches to address this vulnerability. The CVSS score is 9.8, indicating a critical severity level.
The D-Link DIR-600L Hardware Revision B1 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor starts a telnet daemon at boot using the username "Alphanetworks" and a static password stored in a configuration file. Authentication is performed via a custom login binary using simple string comparison, granting root shell access to any attacker on the local network without prior authentication. The device is End-of-Life and will not receive patches for this vulnerability. The CVSS score is 9.8, indicating critical severity.
The D-Link DIR-605L Hardware Revision B2 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor starts a telnet daemon at boot, allowing anyone on the local network to authenticate using the static username "Alphanetworks" and password "wrgn76_dlwbr_dir605L". Successful login grants root shell access with full administrative privileges. The device is End-of-Life and will not receive any patches to address this vulnerability. The CVSS score is 9.8, indicating a critical severity level.
The D-Link DIR-605L Hardware Revision A1 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor runs a telnet daemon at boot, allowing anyone on the local network to authenticate using the static username "Alphanetworks" and password "wrgn35_dlwbr_dir605l". Successful login grants root shell access with full administrative privileges. The device is End-of-Life and will not receive patches to address this vulnerability.