D-Link flaws being used in attacks
CISA lists 26 flaws in D-Link products as being used in attacks, most recently on 24 Apr 2026. 2 have been used in ransomware.
D-LinkBeing used in attacks
- On CISA’s list
- 26 flaws, added between 3 Nov 2021 and 24 Apr 2026
- Most recent
- CVE-2025-29635, D-Link DIR-823X Command Injection Vulnerability, added 24 Apr 2026
- Used in ransomware
- 2 flaws, according to CISA
- Products
- Multiple Routers (3), DCS-2530L and DCS-2670L Devices (2), DIR-859 Router (2), Multiple NAS Devices (2), DCS-930L Devices (1), and 16 more
What to do
- Update every D-Link product you use.Install the updates D-Link offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- D-Link DIR-823X
CVE-2025-29635D-Link DIR-823X Command Injection VulnerabilityD-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link Routers
CVE-2022-37055D-Link Routers Buffer Overflow VulnerabilityD-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link DNR-322L
CVE-2022-40799D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityD-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link DCS-2530L and DCS-2670L Devices
CVE-2020-25079D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityD-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link DCS-2530L and DCS-2670L Devices
CVE-2020-25078D-Link DCS-2530L and DCS-2670L Devices Unspecified VulnerabilityD-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link DIR-859 Router
CVE-2024-0769D-Link DIR-859 Router Path Traversal VulnerabilityD-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - D-Link DIR-820 Router
CVE-2023-25280D-Link DIR-820 Router OS Command Injection VulnerabilityD-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.CISA’s required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. - D-Link DIR-605 Router
CVE-2021-40655D-Link DIR-605 Router Information Disclosure VulnerabilityD-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.CISA’s required actionThis vulnerability affects legacy D-Link products. Read all
All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. - D-Link DIR-600 Router
CVE-2014-100005D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) VulnerabilityD-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.CISA’s required actionThis vulnerability affects legacy D-Link products. Read all
All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. - D-Link Multiple NAS Devices
CVE-2024-3273D-Link Multiple NAS Devices Command Injection VulnerabilityD-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.CISA’s required actionThis vulnerability affects legacy D-Link products. Read all
All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. - D-Link Multiple NAS Devices
CVE-2024-3272D-Link Multiple NAS Devices Use of Hard-Coded Credentials VulnerabilityD-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.CISA’s required actionThis vulnerability affects legacy D-Link products. Read all
All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. - D-Link DSL-2750B Devices
CVE-2016-20017D-Link DSL-2750B Devices Command Injection VulnerabilityD-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - D-Link DWL-2600AP Access Point
CVE-2019-20500D-Link DWL-2600AP Access Point Command Injection VulnerabilityD-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - D-Link DIR-859 Router
CVE-2019-17621D-Link DIR-859 Router Command Execution VulnerabilityD-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - D-Link DIR-820L
CVE-2022-26258D-Link DIR-820L Remote Code Execution VulnerabilityD-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link Multiple Routers
CVE-2018-6530D-Link Multiple Routers OS Command Injection VulnerabilityMultiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.CISA’s required actionThe vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. Read all
If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use. - D-Link DIR-300 Router
CVE-2011-4723D-Link DIR-300 Router Cleartext Storage of a Password VulnerabilityThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link DNS-320 Storage Device
CVE-2019-16057D-Link DNS-320 Remote Code Execution VulnerabilityThe login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link Multiple Routers
CVE-2021-45382D-Link Multiple Routers Remote Code Execution VulnerabilityA remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link DIR-610 Devices
CVE-2020-9377D-Link DIR-610 Devices Remote Command ExecutionD-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link Multiple Routers
CVE-2019-16920D-Link Multiple Routers Command Injection VulnerabilityMultiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link DCS-930L Devices
CVE-2016-11021D-Link DCS-930L Devices OS Command Injection VulnerabilitysetSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link DSL-2760U
CVE-2013-5223D-Link DSL-2760U Gateway Cross-Site Scripting VulnerabilityA cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.CISA’s required actionApply updates per vendor instructions. - D-Link DIR-645 Router
CVE-2015-2051D-Link DIR-645 Router Remote Code Execution VulnerabilityD-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - D-Link DIR-825 R1 Devices
CVE-2020-29557D-Link DIR-825 R1 Devices Buffer Overflow VulnerabilityD-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - D-Link DNS-320 Device
CVE-2020-25506D-Link DNS-320 Device Command Injection VulnerabilityD-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. D-Link on CISA’s site.