A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.
CVE-2026-7289 is a high-severity buffer overflow vulnerability in the D-Link DIR-825M router firmware version 1.1.12. The issue arises from improper handling of the 'submit-url' argument in the /boafrm/formWanConfigSetup function, allowing remote attackers to trigger a buffer overflow. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-7288 is a high-severity buffer overflow vulnerability in the D-Link DIR-825M router firmware version 1.1.12. The vulnerability exists in the function sub_4151FC within the /boafrm/formVpnConfigSetup file, where manipulation of the submit-url argument can trigger a buffer overflow. This flaw can be exploited remotely without user interaction or privileges. Although the exploit code has been publicly disclosed, there are no confirmed reports of active exploitation in the wild. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-7248 is a critical buffer overflow vulnerability in the D-Link DI-8100 router firmware version 16.07.26A1. The flaw exists in the CGI endpoint component, specifically in the tgfile_htm function handling the 'fn' argument. This vulnerability can be exploited remotely without authentication and does not require user interaction. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file_exten_asp of the file file_exten.asp of the component File Extension Handler. The manipulation of the argument Name leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVE-2026-7069 is a high-severity buffer overflow vulnerability in the D-Link DIR-825 router firmware version 3.00b32. The flaw exists in the AddPortMapping function within the miniupnpd component, specifically in the handling of the NewPortMappingDescription argument. Exploitation requires local network access and can lead to significant impact due to the buffer overflow. The affected product is no longer supported by the vendor, and no official patch or remediation is available. Public exploit code has been released, increasing the risk of attacks within local networks.
CVE-2026-7068 is a high-severity buffer overflow vulnerability in the NMBD_process function of the nmbd component in D-Link DIR-825 version 3.00b32. Exploitation requires local network access and no user interaction or privileges are needed. The affected product is no longer supported by the vendor, and no official patch or remediation is available. Although an exploit is publicly available, there are no confirmed reports of exploitation in the wild.
CVE-2026-7067 is a command injection vulnerability in the D-Link DIR-822 router, specifically in version A_101. The flaw exists in the system function of the /udhcpcd/dhcpd.c file within the udhcpd DHCP Service component. An attacker can remotely manipulate the Hostname argument to execute arbitrary commands. The vulnerability has been publicly disclosed and may be exploited. However, this issue affects only devices that are no longer supported by the vendor. No official patch or remediation has been provided.
CVE-2026-7027 is a cross-site scripting (XSS) vulnerability in the D-Link DSL-2740R router, specifically in the Wireless Setup Section of firmware version EU_01.15. The vulnerability arises from improper handling of the Wireless Network Name argument, allowing remote attackers to inject malicious scripts. The exploit is publicly available, but there are no known exploits in the wild. The CVSS score is 4.8, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-7026 is a cross-site scripting (XSS) vulnerability in the D-Link DGS-3420 device, specifically in version 1.50.018. The issue arises from improper handling of the System Name argument on the System Information Settings Page, allowing remote attackers to inject malicious scripts. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. The vulnerability has a medium severity rating with a CVSS score of 6.8.
The D-Link DWM-222W USB Wi-Fi Adapter contains a vulnerability (CVE-2026-6947) that allows unauthenticated adjacent network attackers to bypass brute-force protection mechanisms. This enables attackers to perform unlimited login attempts to gain control over the device. The vulnerability is classified under CWE-307, indicating improper restriction of excessive authentication attempts. The CVSS 4.0 base score is 8.7, reflecting a high severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date.
CVE-2026-6014 is a high-severity buffer overflow vulnerability in the D-Link DIR-513 router firmware version 1.10. The flaw exists in the formAdvanceSetup function of the /goform/formAdvanceSetup POST request handler, where manipulation of the 'webpage' argument can trigger a buffer overflow. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The affected product is no longer supported by the vendor, and no official patch or remediation has been provided. Although an exploit has been published, there are no confirmed reports of exploitation in the wild.
A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A security vulnerability has been detected in D-Link DIR-513 1.10. This affects the function formSetPassword of the file /goform/formSetPassword of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability was identified in D-Link DIR-605L 2.13B01. Impacted is the function formSetLog of the file /goform/formSetLog of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects the function formSetDDNS of the file /goform/formSetDDNS of the component POST Request Handler. Executing a manipulation of the argument curTime can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects the function formAdvNetwork of the file /goform/formAdvNetwork of the component POST Request Handler. Performing a manipulation of the argument curTime results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in D-Link DIR-605L 2.13B01. This affects the function formAdvFirewall of the file /goform/formAdvFirewall of the component POST Request Handler. Such manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.