---METADATA---
VENDOR: D-Link
PRODUCT: DNS-340L ShareCenter
AFFECTED_VERSIONS: 1.01B04
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-04T09:03:17.529Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/398422","name":"VDB-398422 | D-Link DNS-340L CGI dropbox.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/398422/cti","name":"VDB-398422 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-85223","name":"CVE-2026-85223 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894213","name":"Submit #894213 | D-Link DNS-340L ShareCenter confirmed DNS-340L firmware builds OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-008-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DNS-340L dropbox.cgi handler allows authenticated remote attackers to execute arbitrary OS commands via manipulated POST parameters.

Executive Summary:
A critical OS command injection vulnerability in the D-Link DNS-340L ShareCenter allows authenticated remote attackers to execute arbitrary commands, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-85223

Affected Software: D-Link DNS-340L ShareCenter

Affected Versions: 1.01B04

Vulnerability: The application fails to properly sanitize input in the callback_url and sync_interval parameters within the dropbox.cgi script. An authenticated attacker can inject shell metacharacters into these parameters, which are then passed to a system shell for execution by the dropnasctl utility.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the CGI process. This can lead to complete system takeover, unauthorized access to sensitive backup data, or the disruption of NAS services. Given the CVSS score of 9.9, this vulnerability represents a critical security risk that could result in significant data loss or operational downtime.

Remediation Plan

Immediate Action: As no patch is currently identified, administrators should restrict access to the web management interface to trusted internal networks only. If the Dropbox synchronization feature is not business-critical, disable it immediately through the administrative interface.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or attempts to invoke shell-related characters in network requests directed at the /cgi-bin/dropbox.cgi endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect POST requests and filter out suspicious shell metacharacters, such as semicolons and command substitution sequences, within the callback_url and sync_interval fields.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the provided technical research write-up.

Analyst Notes: As of Sep 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists via the researcher's published write-up, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on user-controlled parameters passed directly to the system shell.

Analyst Recommendation

This vulnerability is critical due to the potential for full remote command execution. Security teams must prioritize isolating affected NAS devices from public internet access. Until a vendor-supplied firmware update is released, users must rely on network segmentation and internal access restrictions to prevent unauthorized exploitation of this flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS-340L and DNS-345 ShareCenter
AFFECTED_VERSIONS: D-Link DNS-340L: 20260717, D-Link DNS-345: 20260717
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:02:55.265Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397180","name":"VDB-397180 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397180/cti","name":"VDB-397180 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82692","name":"CVE-2026-82692 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894211","name":"Submit #894211 | D-Link DNS-340L/DNS-345 ShareCenter confirmed ShareCenter firmware builds OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-006-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
D-Link DNS-340L and DNS-345 devices are vulnerable to OS command injection via the iscsi_mgr.cgi script, allowing authenticated remote attackers to execute arbitrary commands.

Executive Summary:
An OS command injection vulnerability in D-Link ShareCenter NAS devices allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-82692

Affected Software: D-Link DNS-340L and DNS-345 ShareCenter

Affected Versions: D-Link DNS-340L: 20260717, D-Link DNS-345: 20260717

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring within the iscsi_mgr.cgi script. The application fails to sanitize user-supplied input in the alias, username, password, and volume_location parameters before passing them to system shell commands, allowing an authenticated attacker to execute arbitrary code.

Business Impact

Successful exploitation poses a critical risk to business operations, as it grants the attacker remote code execution capabilities with the privileges of the CGI process. This could result in the total compromise of stored data, unauthorized access to network resources, or service disruption of critical storage infrastructure. Given the CVSS score of 9.9, this vulnerability represents a severe threat to system integrity and confidentiality.

Remediation Plan

Immediate Action: Since no vendor patch is currently confirmed, administrators should restrict access to the web management interface to trusted internal networks only. If iSCSI management is not actively required, disable the service or the web interface entirely until a vendor-supplied firmware update is available.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at /cgi-bin/iscsi_mgr.cgi, specifically looking for shell metacharacters such as semicolons, pipe symbols, or backticks within parameters. Audit the filesystem for unexpected files created in /tmp or other temporary directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize HTTP POST requests to /cgi-bin/iscsi_mgr.cgi that contain shell metacharacters. Ensure that administrative access to the device is segmented from general user traffic.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing functional proof-of-concept injection strings exists, as cited in the research documentation from the vulnerability discovery.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input neutralization in the affected CGI script.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of proof-of-concept material, immediate defensive action is required. Organizations using affected D-Link ShareCenter devices must prioritize restricting administrative access to the web interface and monitor for signs of unauthorized command execution. Continue to monitor vendor support channels for the release of security-hardened firmware updates.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS-320L, DNS-327L, DNS-340L, DNS-345 ShareCenter NAS
AFFECTED_VERSIONS: Up to 20260717
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:10.450Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397179","name":"VDB-397179 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397179/cti","name":"VDB-397179 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82691","name":"CVE-2026-82691 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894210","name":"Submit #894210 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmwar","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-005-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
D-Link ShareCenter NAS devices are vulnerable to OS command injection via the f_ups_ip parameter in the usb_device.cgi script, allowing authenticated remote attackers to execute arbitrary shell commands.

Executive Summary:
An authenticated remote command injection vulnerability in D-Link ShareCenter NAS devices poses a critical risk by allowing attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-82691

Affected Software: D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 ShareCenter NAS

Affected Versions: All firmware versions up to 20260717

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring within the CGI handler for UPS management. An authenticated attacker can manipulate the f_ups_ip parameter to inject shell metacharacters and execute unauthorized commands on the underlying system.

Business Impact

A successful exploit grants the attacker full control over the affected NAS appliance. This can lead to the total compromise of stored data, unauthorized access to sensitive network segments, or complete service disruption. Given the CVSS score of 9.1, this vulnerability represents a severe threat to operational continuity and data confidentiality.

Remediation Plan

Immediate Action: Restrict access to the web management interface to trusted administrative IP addresses only, and monitor for any vendor-issued firmware updates that address the insecure handling of the f_ups_ip parameter.

Proactive Monitoring: Review system logs for unusual POST requests directed at /cgi-bin/usb_device.cgi, specifically monitoring for command characters such as semicolons, pipes, or backticks within the f_ups_ip field.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block HTTP traffic containing malicious shell metacharacters in the f_ups_ip POST parameter, effectively neutralizing the injection vector.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing a working proof-of-concept for the vulnerability has been published by a security researcher.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild, but the existence of a published proof-of-concept renders the exploitation risk credible. The vulnerability is highly exploitable as it stems from a lack of input sanitization in a standard CGI configuration interface.

Analyst Recommendation

Given the high severity and the availability of a public proof-of-concept, administrators must treat this vulnerability with high urgency. Immediately restrict administrative access to the NAS management interface and implement WAF rules to filter malicious traffic until a vendor patch is applied. Failure to remediate could allow an attacker to gain persistent, unauthorized control over storage infrastructure.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS-327L and DNS-340L ShareCenter
AFFECTED_VERSIONS: DNS-327L (up to 20260717), DNS-340L (up to 20260717)
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:18.187Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397178","name":"VDB-397178 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397178/cti","name":"VDB-397178 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82690","name":"CVE-2026-82690 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894209","name":"Submit #894209 | D-Link DNS-327L/DNS-340L ShareCenter confirmed ShareCenter firmware builds OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-004-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the D-Link ShareCenter NAS allows authenticated remote attackers to execute arbitrary commands via the f_dev parameter in /cgi-bin/ve_mgr.cgi.

Executive Summary:
A critical OS command injection vulnerability in D-Link ShareCenter NAS devices allows authenticated attackers to execute arbitrary system commands, posing a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-82690

Affected Software: D-Link DNS-327L and DNS-340L ShareCenter

Affected Versions: Up to firmware version 20260717

Vulnerability: The vulnerability exists in the ve_mgr.cgi script, which fails to neutralize shell metacharacters in the f_dev POST parameter before passing it to a system shell command. This allows an authenticated user to perform OS command injection and execute arbitrary code as the CGI process user.

Business Impact

Successful exploitation grants an attacker full control over the NAS appliance. This could lead to unauthorized access to sensitive stored data, complete system disruption, or the potential use of the compromised device as a pivot point within the internal network. With a CVSS score of 9.1, this vulnerability represents a critical risk to organizational data integrity and availability.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch available for this vulnerability. Administrators should restrict access to the web management interface to trusted internal networks only and disable remote management features until a firmware update is released.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at /cgi-bin/ve_mgr.cgi, particularly those containing shell metacharacters like semicolons or pipe symbols in the f_dev parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block HTTP POST requests to the /cgi-bin/ve_mgr.cgi endpoint that contain suspicious command-line sequences or shell characters.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing a functional proof-of-concept is publicly available via the GitHub repository referenced in the vulnerability research documentation.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the management interface.

Analyst Recommendation

Given the critical severity of this command injection flaw and the availability of a public proof-of-concept, immediate defensive action is required. Organizations using these D-Link storage devices should isolate the management interface from the internet and monitor for any signs of unauthorized access or exploitation attempts while awaiting a formal firmware update from the vendor.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS-320L, DNS-327L, DNS-340L, DNS-345
AFFECTED_VERSIONS: Up to 20260717
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:02.811Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397177","name":"VDB-397177 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397177/cti","name":"VDB-397177 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82689","name":"CVE-2026-82689 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894201","name":"Submit #894201 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmwar","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the ISO Image Handler component of multiple D-Link NAS devices, allowing authenticated remote attackers to execute arbitrary commands via the upIsoRootPath.

Executive Summary:
An authenticated remote code execution vulnerability in D-Link ShareCenter NAS devices poses a critical risk to data integrity and network security.

Vulnerability Details

CVE-ID: CVE-2026-82689

Affected Software: D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345

Affected Versions: Firmware builds up to 20260717

Vulnerability: The vulnerability is an OS command injection flaw located in the /cgi-bin/isomount_mgr.cgi script. An attacker with authenticated administrative access to the web interface can manipulate the upIsoRootPath parameter to inject and execute arbitrary shell commands with the privileges of the CGI process.

Business Impact

Successful exploitation allows an attacker to gain full control over the affected network-attached storage device. This can lead to unauthorized access to sensitive stored data, the modification of system configurations, disruption of services, or the use of the NAS as a pivot point to conduct further attacks within the internal network. The CVSS score of 9.9 reflects the severe impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update affected D-Link NAS devices to the latest available firmware provided by the vendor. If an update is not immediately available, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web access logs for unusual POST requests directed at /cgi-bin/isomount_mgr.cgi, particularly those containing shell metacharacters such as semicolons or pipe symbols in the upIsoRootPath parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious command injection patterns directed at the identified CGI endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct injection of user-supplied input into system shell commands.

Analyst Recommendation

Given the critical CVSS severity and the presence of a public proof-of-concept, users must prioritize patching these devices immediately. Administrative interfaces for storage devices should never be exposed to the public internet, and internal access should be strictly governed by the principle of least privilege to mitigate the impact of compromised credentials.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS-340L and DNS-345 ShareCenter
AFFECTED_VERSIONS: DNS-340L: 1.01B04; DNS-345: 1.01B04, 1.03B06, 1.04.B02, 1.05b04
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:03:26.124Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397176","name":"VDB-397176 | D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397176/cti","name":"VDB-397176 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82688","name":"CVE-2026-82688 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894190","name":"Submit #894190 | D-Link DNS-340L/DNS-345 ShareCenter DNS-340L REVA 1.01B04; DNS-345 REVA 1.03B06/1.04.B02/1.05b04 HOTFIX","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-001-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
D-Link DNS-340L and DNS-345 NAS devices are vulnerable to OS command injection via the virtual_vol.cgi handler, allowing authenticated attackers to execute arbitrary commands with system privileges.

Executive Summary:
An authenticated OS command injection vulnerability in D-Link DNS-340L and DNS-345 NAS devices poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-82688

Affected Software: D-Link DNS-340L and DNS-345 ShareCenter

Affected Versions: DNS-340L: 1.01B04; DNS-345: 1.01B04, 1.03B06, 1.04.B02, 1.05b04

Vulnerability: This is an OS command injection flaw (CWE-78) within the virtual_vol.cgi file. An authenticated attacker can manipulate HTTP POST parameters, specifically f_sharename, f_target, and f_name, to inject shell metacharacters that are executed by the underlying system shell.

Business Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the CGI process, effectively granting them full control over the NAS appliance. This could lead to unauthorized access to sensitive stored data, the installation of persistent backdoors, or the use of the device as a pivot point to attack other internal network resources. Given the CVSS score of 9.1, this vulnerability is classified as critical and represents a significant risk to organizational data integrity and infrastructure security.

Remediation Plan

Immediate Action: Since a specific patch is currently unavailable, restrict access to the web management interface to trusted administrative IP addresses only. Disable the Virtual Volume management features if they are not strictly required for daily operations.

Proactive Monitoring: Monitor system logs for unusual HTTP POST requests directed at /cgi-bin/virtual_vol.cgi, particularly those containing shell metacharacters such as semicolons, pipes, or backticks. Inspect the device for the presence of unexpected files in the /tmp directory or unauthorized changes to system configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP POST requests that contain suspicious characters within the f_sharename, f_target, or f_name parameters.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing detailed reproduction steps and proof-of-concept payloads is publicly available via GitHub.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation in the wild; however, the publication of a detailed proof-of-concept increases the likelihood of opportunistic attacks. The vulnerability is highly exploitable due to the lack of input sanitization in the CGI handler.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for remote code execution. Administrators should prioritize restricting network access to the management interface of affected D-Link devices immediately. Maintain vigilance for vendor updates and apply the necessary firmware patches as soon as they become available to permanently remediate this command injection flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DSM-G600
AFFECTED_VERSIONS: 1.01
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:08:58.406Z
CREDITS: ST4R0001 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397175","name":"VDB-397175 | D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/397175/cti","name":"VDB-397175 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82680","name":"CVE-2026-82680 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894188","name":"Submit #894188 | D-Link DSM-G600 REVA 1.01 Buffer Overflow / Out-of-bounds Write candidate","tags":["third-party-advisory"]},{"url":"https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-BOF-001-vulndb.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the D-Link DSM-G600 multipart handler allows authenticated remote attackers to trigger a denial of service via specifically crafted configuration files.

Executive Summary:
An authenticated remote memory corruption vulnerability in the D-Link DSM-G600 firmware allows attackers to crash the management interface, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-82680

Affected Software: D-Link DSM-G600

Affected Versions: 1.01

Vulnerability: This vulnerability is an out-of-bounds write flaw occurring within the load_file.cgi component of the HTTP management daemon. An attacker with administrative credentials can trigger a segmentation fault by submitting an oversized multipart POST request, leading to a denial of service.

Business Impact

The successful exploitation of this vulnerability results in the disruption of the device management interface, which prevents administrators from reconfiguring or monitoring the affected hardware. While the CVSS score of 8.8 suggests high severity, the impact is primarily limited to a denial of service condition for the administrative interface rather than unauthorized data access. Nevertheless, the instability of critical network infrastructure components presents a significant operational risk.

Remediation Plan

Immediate Action: Since no official patch is currently available, restrict access to the device web management interface to trusted management networks only to prevent unauthorized authentication.

Proactive Monitoring: Monitor device logs for repeated authentication attempts followed by service crashes or unexpected reboots of the HTTP daemon.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level traffic filtering to inspect and block multipart POST requests to /load_file.cgi that exceed standard configuration file sizes.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept script exists as documented in the research write-up by the vulnerability reporter.

Analyst Notes: As of September 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any user capable of authenticating to the web management interface, which is a common vector for attackers who have compromised default or weak credentials.

Analyst Recommendation

Given the availability of public proof-of-concept code and the critical nature of network storage devices, administrators must prioritize restricting access to the management console immediately. While the vendor is expected to release a fix, organizations should treat this device as high-risk and ensure it is not exposed to the public internet until a firmware update is applied.

---METADATA---
VENDOR: D-Link
PRODUCT: DCS-935L
AFFECTED_VERSIONS: 1.10.01
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the D-Link DCS-935L HNAP service can lead to buffer overflows and potentially arbitrary code execution.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DCS-935L camera allows authenticated attackers to execute arbitrary code via the HNAP service.

Vulnerability Details

CVE-ID: CVE-2026-8260

Affected Software: D-Link DCS-935L

Affected Versions: 1.10.01

Vulnerability: This is a memory corruption and buffer overflow vulnerability within the HNAP service. It requires the attacker to have low-level authentication to trigger the flaw.

Business Impact

Exploitation of this vulnerability could grant an attacker full control over the affected camera, potentially leading to unauthorized surveillance or use of the device as a pivot point in the network. The CVSS score of 8.8 underscores the high severity and the potential for complete system compromise.

Remediation Plan

Immediate Action: Check the D-Link support portal for the latest firmware release and apply it to the DCS-935L device.

Proactive Monitoring: Monitor for unexpected reboots or crashes of the camera's HNAP service, which could indicate exploitation attempts.

Compensating Controls: Isolate the camera on a restricted VLAN and limit management access to the HNAP service to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Buffer overflow vulnerabilities in network-facing services are inherently dangerous and often targeted for remote code execution.

Analyst Recommendation

Given the high CVSS score and the nature of the device, users should prioritize firmware updates. If a patch is unavailable, restrict network access to the device to mitigate the risk of remote exploitation by authenticated attackers.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825M
AFFECTED_VERSIONS: 1.1.8
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:07:39.896Z
CREDITS: hacker128 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397090","name":"VDB-397090 | D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397090/cti","name":"VDB-397090 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82595","name":"CVE-2026-82595 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892630","name":"Submit #892630 | D-Link DIR-825M v1.1.8 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formSysCmd/formSysCmd.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
D-Link DIR-825M firmware version 1.1.8 contains a command injection vulnerability in the /boafrm/formSysCmd endpoint, allowing remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical command injection vulnerability in D-Link DIR-825M routers allows authenticated attackers to achieve remote code execution with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-82595

Affected Software: D-Link DIR-825M

Affected Versions: 1.1.8

Vulnerability: This is a command injection vulnerability (CWE-77) located in the sub_456CF4 function of the /boafrm/formSysCmd file, where unsanitized user input from the sysCmd parameter is passed directly to the system shell. An attacker with low privileges (authenticated via web session) can inject shell operators to execute arbitrary commands on the underlying operating system.

Business Impact

Successful exploitation permits an attacker to gain full control over the router, potentially leading to complete device takeover, modification of DNS settings, or the interception of network traffic. Given the CVSS score of 7.4, this vulnerability represents a high risk to organizational network integrity and confidentiality. Unauthorized command execution at the root level can facilitate further lateral movement within the internal network.

Remediation Plan

Immediate Action: As no patch is currently available, immediately restrict access to the web management interface to trusted internal segments only and disable remote administration features.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boafrm/formSysCmd endpoint and review system logs for shell metacharacter usage.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to block HTTP requests containing semicolon, ampersand, or pipe characters within the sysCmd parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists per the technical write-up referenced in the CVE record.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, a functional proof-of-concept has been published by researchers, making exploitation risk credible for exposed devices. The vulnerability is highly exploitable due to the lack of input validation and the execution of commands with root privileges.

Analyst Recommendation

Due to the severity of remote code execution and the availability of a public proof-of-concept, administrators should prioritize isolating affected D-Link DIR-825M devices from the public internet. Ensure that administrative interfaces are not reachable from untrusted networks and monitor for firmware updates from the vendor to remediate this flaw once a patch is released.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825M
AFFECTED_VERSIONS: 1.1.8, 1.1.12
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:01:14.514Z
CREDITS: hacker128 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397088","name":"VDB-397088 | D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397088/cti","name":"VDB-397088 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82593","name":"CVE-2026-82593 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892516","name":"Submit #892516 | D-Link DIR-825M v1.1.8 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formLtefotaUpgradeFibocom/formLtefotaUpgradeFibocom.md","name":null,"tags":["exploit","patch"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
D-Link DIR-825M routers contain a stack-based buffer overflow and command injection vulnerability in the firmware upgrade function, allowing remote code execution with root privileges.

Executive Summary:
A critical remote code execution vulnerability exists in D-Link DIR-825M routers that allows unauthenticated attackers to gain root access via manipulated firmware upgrade requests.

Vulnerability Details

CVE-ID: CVE-2026-82593

Affected Software: D-Link DIR-825M

Affected Versions: 1.1.8, 1.1.12

Vulnerability: The vulnerability resides in the /boafrm/formLtefotaUpgradeFibocom endpoint, where the fota_url parameter is processed by the sub_41802C function. Due to insecure substring validation and the use of sprintf without bounds checking, an attacker can perform command injection or trigger a stack-based buffer overflow to execute arbitrary code as root.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected D-Link router with root privileges. This level of access allows for total system compromise, including the ability to intercept network traffic, modify device configurations, or utilize the device as a persistent foothold within the internal network. Given the critical CVSS score of 9.9, this vulnerability presents an extreme risk to organizational security and data confidentiality.

Remediation Plan

Immediate Action: Disconnect affected D-Link DIR-825M devices from the internet immediately if firmware updates are not available or if the device cannot be patched.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boafrm/formLtefotaUpgradeFibocom endpoint and audit system logs for unexpected command executions or service crashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter and block HTTP POST requests containing suspicious shell control characters or excessively long strings directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Analyst Notes: As of August 30, 2026, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization and the direct execution of user-supplied data in a system call.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent full system compromise. Administrators must verify if their devices are running the affected firmware versions and apply the manufacturer provided patches as soon as they are available. If patching is not immediately feasible, restrict management interface access to trusted internal networks only to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825M
AFFECTED_VERSIONS: 1.1.8
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:01:22.131Z
CREDITS: hacker128 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397087","name":"VDB-397087 | D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397087/cti","name":"VDB-397087 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82592","name":"CVE-2026-82592 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892514","name":"Submit #892514 | D-Link DIR-825M v1.1.8 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formDiskFormat/formDiskFormat.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A stack-based buffer overflow and command injection vulnerability in the D-Link DIR-825M disk formatting endpoint allows authenticated remote attackers to execute arbitrary code.

Executive Summary:
The D-Link DIR-825M router is vulnerable to remote code execution due to improper input validation in the disk formatting handler, posing a critical risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-82592

Affected Software: D-Link DIR-825M

Affected Versions: 1.1.8

Vulnerability: This vulnerability consists of a stack-based buffer overflow and command injection triggered via the partition parameter in the /boafrm/formDiskFormat endpoint. The flaw allows an authenticated attacker to inject shell metacharacters or overflow the stack to gain root-level command execution.

Business Impact

A successful exploitation of this vulnerability grants an attacker full control over the router with root privileges. This could lead to total compromise of network traffic, unauthorized access to internal resources, and permanent denial of service for the device. Given the CVSS score of 9.9, this vulnerability represents an extremely high risk to operational continuity and data confidentiality.

Remediation Plan

Immediate Action: Update the firmware of the D-Link DIR-825M to the latest available version provided by the manufacturer. If no patch is currently available, immediately restrict access to the web management interface.

Proactive Monitoring: Review web access logs for anomalous POST requests directed at the /boafrm/formDiskFormat endpoint, specifically monitoring for unusually long partition parameters or shell metacharacters.

Compensating Controls: Implement access control lists (ACLs) to limit management interface access to trusted administrative IP addresses only. A Web Application Firewall (WAF) may be configured to block requests containing suspicious characters like semicolons or pipes in the partition parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the research write-up referenced in the CVE record.

Analyst Notes: As of August 30, 2026, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept is available via the researcher's published technical report. The vulnerability is highly exploitable due to the lack of sanitization on user-supplied input.

Analyst Recommendation

Due to the severity of this flaw and the availability of public exploitation details, it is imperative that administrators take immediate action. Restricting management access and applying the necessary firmware updates are the only effective ways to mitigate the risk of full device compromise and potential lateral movement within the network.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: D-Link DI-8100: 16.07.26A1
CONFIDENCE: high
MISSING: patch
CREDITS: draw (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361134","name":"VDB-361134 | D-Link DI-8100 CGI user_group.asp sprintf buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361134/cti","name":"VDB-361134 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807853","name":"Submit #807853 | D-Link DI-8100 16.07.26A1 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/draw-ctf/report/blob/main/DI-8100/user_group_asp_overflow.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:42:46.397Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DI-8100 web management interface allows authenticated attackers to crash the device or execute arbitrary code via the user_group.asp endpoint.

Executive Summary:
A stack-based buffer overflow vulnerability in the D-Link DI-8100 web management interface allows an authenticated attacker to achieve remote code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7857

Affected Software: D-Link DI-8100

Affected Versions: D-Link DI-8100: 16.07.26A1

Vulnerability: This is a stack-based buffer overflow vulnerability caused by unsafe use of the sprintf function within the CGI handler for the /user_group.asp endpoint, requiring high privileges for successful exploitation.

Business Impact

A successful exploit can lead to a complete denial of service of the affected network device or remote code execution, potentially granting an attacker full control over the router. This severity is underscored by a CVSS score of 7.2, reflecting high technical impact on system integrity, availability, and confidentiality.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available from D-Link, or restrict administrative access to trusted internal networks only.

Proactive Monitoring: Monitor device logs for anomalous HTTP POST requests directed at the /user_group.asp endpoint and watch for unexpected device reboots or service crashes.

Compensating Controls: Implement strict network segmentation and restrict access to the device management interface using firewall rules to block unauthorized connections.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub security advisory.

Analyst Notes: As of May 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is triggered by sending an overly long string in HTTP POST parameters to an authenticated endpoint.

Analyst Recommendation

Given the high severity and the availability of a public proof-of-concept, administrators should immediately restrict administrative management interfaces from the public internet. Apply official firmware updates from D-Link as soon as they are released to permanently resolve the underlying buffer overflow condition.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: D-Link DI-8100: 16.07.26A1
CONFIDENCE: high
MISSING: patch
CREDITS: draw (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361133","name":"VDB-361133 | D-Link DI-8100 Web Management url_member.asp buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361133/cti","name":"VDB-361133 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807849","name":"Submit #807849 | D-Link DI-8100 16.07.26A1 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/draw-ctf/report/blob/main/DI-8100/url_member_asp_overflow.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:42:54.129Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DI-8100 router web management interface allows authenticated administrators to execute arbitrary code via the url_member.asp endpoint.

Executive Summary:
A stack-based buffer overflow in the D-Link DI-8100 router web management interface allows an authenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7856

Affected Software: D-Link DI-8100

Affected Versions: D-Link DI-8100: 16.07.26A1

Vulnerability: This flaw is a buffer overflow (CWE-120) occurring within the Web Management Interface via the url_member.asp file, where manipulating the Name argument allows memory corruption. The attack requires high privileges, specifically an authenticated administrator session.

Business Impact

A successful exploit of this vulnerability can result in total system compromise, allowing an attacker to execute arbitrary code on the affected D-Link router. This level of access grants complete control over network traffic routing, potentially leading to widespread internal network reconnaissance, interception, or persistent device disruption. The assigned CVSS score of 7.2 reflects the high severity of potential impact, balanced against the requirement for administrative authentication.

Remediation Plan

Immediate Action: Restrict administrative access to the web management interface of the D-Link DI-8100 to trusted internal management networks only, and monitor for vendor firmware releases that address this buffer overflow.

Proactive Monitoring: Audit device access logs and session activity for anomalous administrative requests targeting the url_member.asp endpoint, particularly those involving unusually long parameter strings.

Compensating Controls: Implement strict network segmentation and firewall rules to ensure that the device management interface is never exposed directly to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists in the referenced GitHub security advisory and VulDB record.

Analyst Notes: As of May 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a functional proof-of-concept targeting the url_member.asp parameter raises the operational risk for unpatched devices.

Analyst Recommendation

Given the severity of potential memory corruption and remote code execution, administrators must ensure that device management interfaces are isolated from untrusted networks. Apply any forthcoming vendor security updates immediately once released, and maintain vigilant access logging to detect unauthorized administrative manipulation.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: D-Link DI-8100: 16.07.26A1
CONFIDENCE: high
MISSING: patch, technical_details
CREDITS: draw (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361132","name":"VDB-361132 | D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361132/cti","name":"VDB-361132 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807841","name":"Submit #807841 | D-Link DI-8100 16.07.26A1 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/draw-ctf/report/blob/main/DI-8100/tggl_asp_overflow.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:40:33.251Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the D-Link DI-8100 router firmware via the tggl.asp component, allowing authenticated attackers to cause a denial of service or remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DI-8100 router firmware allows authenticated remote attackers to trigger memory corruption and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7855

Affected Software: D-Link DI-8100

Affected Versions: D-Link DI-8100: 16.07.26A1

Vulnerability: This is a buffer overflow vulnerability (CWE-120) located in the tggl_asp function of the /tggl.asp HTTP Request Handler, triggered by manipulating the Name parameter with low privileges required.

Business Impact

A successful exploit of this vulnerability can lead to a complete denial of service by crashing the router web management service or forcing a device reboot, disrupting network operations. Furthermore, memory corruption vulnerabilities on embedded router devices can potentially enable remote code execution, granting attackers full administrative control over the underlying networking hardware. The high CVSS score of 8.8 reflects the severity of potential total system impact and loss of availability.

Remediation Plan

Immediate Action: Apply firmware updates provided by D-Link as soon as they become available to address the underlying memory corruption flaw.

Proactive Monitoring: Monitor network and administrative logs for unusual crashes of the web management service or repeated authentication attempts followed by suspicious request payloads.

Compensating Controls: Restrict administrative access to the router management interface to trusted internal network segments and disable external management exposure.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exploit exists via a referenced GitHub repository containing a functional Python script.

Analyst Notes: As of May 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from unbounded string handling operations processing untrusted input from remote users.

Analyst Recommendation

Given the critical severity and the availability of a public proof-of-concept exploit, administrators must treat this issue with high urgency. Restrict administrative access immediately while monitoring vendor channels for official firmware patches to secure affected routing hardware.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: 16.07.26A1
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DI-8100 POST parameter handler allows remote attackers to execute arbitrary code via the url_rule.asp function.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DI-8100 routers poses a severe risk of remote code execution and full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7854

Affected Software: D-Link DI-8100

Affected Versions: 16.07.26A1

Vulnerability: The vulnerability exists within the url_rule_asp function of the /url_rule.asp component. An unauthenticated remote attacker can trigger a buffer overflow by sending a maliciously crafted POST request to the device.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to organizational infrastructure. Successful exploitation grants an attacker full control over the affected gateway, potentially enabling lateral movement, traffic interception, and the complete compromise of internal network security.

Remediation Plan

Immediate Action: Update the firmware of the D-Link DI-8100 device to the latest version provided by the manufacturer.

Proactive Monitoring: Inspect network traffic for anomalous POST requests directed at the /url_rule.asp path and review device logs for signs of unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering to block malicious POST payloads targeting the vulnerable URL until firmware can be applied.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of May 5, 2026, public exploits for this vulnerability are available and actively circulating. Given the critical severity and ease of remote exploitation, immediate patching is required to prevent unauthorized access.

Analyst Recommendation

This vulnerability is critical and poses an immediate threat to the perimeter of any network utilizing the affected D-Link hardware. Administrators must prioritize the application of the vendor-supplied security update to neutralize the risk of remote code execution.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: 16.07.26A1
---END_METADATA---

Description Summary:
D-Link DI-8100 is vulnerable to a remote buffer overflow in the sprintf function within the HTTP Handler's /auto_reboot.asp script.

Executive Summary:
A critical buffer overflow in the D-Link DI-8100 router allows remote unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-7853

Affected Software: D-Link DI-8100

Affected Versions: 16.07.26A1

Vulnerability: The vulnerability is a buffer overflow occurring in the sprintf function within the /auto_reboot.asp file of the HTTP Handler component, triggered by improper handling of the enable/time argument.

Business Impact

With a CVSS score of 9.8, this flaw allows for Remote Code Execution. Exploitation can lead to full router compromise, providing the attacker with persistent access to the network, the ability to intercept traffic, or redirecting users to malicious sites.

Remediation Plan

Immediate Action: Update the device firmware to the latest version. If no update is available, disable the web-based management interface.

Proactive Monitoring: Monitor logs for abnormal reboot requests or suspicious HTTP traffic directed at the router's management interface.

Compensating Controls: Use firewall rules to restrict access to the web management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: The exploit for this vulnerability is publicly available, which significantly increases the urgency for remediation. Immediate action is required to secure the device.

Analyst Recommendation

Due to the public availability of exploit code, this router is at extreme risk. If a firmware update cannot be applied immediately, the router's management interface must be taken offline or restricted to trusted networks to prevent compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: D-Link DI-8100: 16.07.26A1
CONFIDENCE: high
MISSING: patch
CREDITS: draw (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361128","name":"VDB-361128 | D-Link DI-8100 yyxz.asp sprintf stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361128/cti","name":"VDB-361128 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807798","name":"Submit #807798 | D-Link DI-8100 16.07.26A1 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/draw-ctf/report/blob/main/DI-8100/yyxz_dlink_asp_overflow.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:43:01.597Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DI-8100 router allows authenticated administrators to achieve remote code execution via the yyxz.asp endpoint.

Executive Summary:
A stack-based buffer overflow vulnerability in the D-Link DI-8100 administrative interface allows authenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7851

Affected Software: D-Link DI-8100

Affected Versions: D-Link DI-8100: 16.07.26A1

Vulnerability: This flaw is a stack-based buffer overflow (CWE-121) located in the sprintf function within the yyxz.asp endpoint, triggered by manipulating the id parameter with valid administrative credentials.

Business Impact

A successful exploit of this vulnerability can result in total compromise of the affected routing device, leading to severe network disruption, unauthorized interception of traffic, or complete loss of administrative control. The CVSS score of 7.2 reflects high technical severity due to the potential for complete confidentiality, integrity, and availability impact, though mitigated slightly by the requirement for administrative authentication.

Remediation Plan

Immediate Action: Restrict administrative access to trusted internal management networks only, and disable external web management interfaces until a vendor-supplied firmware update is available.

Proactive Monitoring: Monitor device availability and system logs for unexpected reboots, HTTP service crashes, or anomalous HTTP POST requests directed at the yyxz.asp endpoint.

Compensating Controls: Implement strict network segmentation and access control lists to prevent unauthorized hosts from reaching the router management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists in the referenced GitHub write-up.

Analyst Notes: As of May 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of working proof-of-concept code increases the urgency for network administrators to restrict administrative access.

Analyst Recommendation

Organizations utilizing the D-Link DI-8100 router must treat this high-severity vulnerability with urgency. Given the presence of a public proof-of-concept and the potential for total system compromise, administrators should immediately restrict management interface exposure and apply vendor patches as soon as they are released.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825M
AFFECTED_VERSIONS: 1.1.12
CONFIDENCE: high
MISSING: patch
CREDITS: kiciot (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359947","name":"VDB-359947 | D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359947/cti","name":"VDB-359947 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/803025","name":"Submit #803025 | dlink DIR-825m v1.1.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Kiciot/cve/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.671Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-825M router allows remote attackers to trigger memory corruption and potential code execution via the submit-url parameter.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-825M firmware version 1.1.12 allows remote, unauthenticated attackers to potentially gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-7289

Affected Software: D-Link DIR-825M

Affected Versions: 1.1.12

Vulnerability: The vulnerability exists within the sub_414BA8 function of the /boafrm/formWanConfigSetup endpoint, which fails to perform bounds checking when processing the submit-url parameter. This flaw allows an unauthenticated remote attacker to overwrite stack memory via a specifically crafted POST request.

Business Impact

Successful exploitation poses a severe risk to organizational network integrity. An attacker gaining control of a router can intercept sensitive traffic, pivot into internal network segments, or render the device inaccessible, leading to significant operational downtime. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate attention.

Remediation Plan

Immediate Action: Contact D-Link support or monitor the official vendor security portal for a firmware update, as no patched version is currently confirmed available. If no update is provided, consider retiring the device from production environments.

Proactive Monitoring: Review system logs for anomalous POST requests directed at the /boafrm/formWanConfigSetup endpoint, particularly those containing excessively long parameter strings. Monitor for unexpected device reboots or changes in routing behavior that may indicate successful memory corruption attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming HTTP requests containing oversized values in the submit-url parameter. Restrict access to the router management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up hosted on GitHub.

Analyst Notes: As of April 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the underlying function uses the unsafe strcpy operation without validating input length.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-severity nature of the flaw, this vulnerability presents a credible risk to network security. Organizations should prioritize the identification of affected hardware and apply vendor-supplied patches as soon as they are released. In the absence of a firmware update, the risk should be mitigated by restricting network access to the device management interface or isolating the hardware from untrusted networks.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825M
AFFECTED_VERSIONS: 1.1.12
CONFIDENCE: high
MISSING: patch
CREDITS: kiciot (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359946","name":"VDB-359946 | D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359946/cti","name":"VDB-359946 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/803024","name":"Submit #803024 | Dlink DIR-825m v1.1.12 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Kiciot/cve/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.675Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-825M router allows remote attackers to execute arbitrary code via the submit-url parameter in the /boafrm/formVpnConfigSetup endpoint.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-825M firmware allows remote attackers to achieve arbitrary code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7288

Affected Software: D-Link DIR-825M

Affected Versions: 1.1.12

Vulnerability: The vulnerability exists within the sub_4151FC function of the /boafrm/formVpnConfigSetup endpoint, which performs an unsafe copy of the submit-url parameter using strcpy. This allows an unauthenticated attacker to trigger a stack-based buffer overflow by supplying an oversized input string.

Business Impact

Successful exploitation of this flaw can lead to a complete compromise of the affected router, allowing an attacker to monitor network traffic, modify configuration settings, or use the device as a pivot point for further internal network attacks. Given the CVSS score of 8.8, the potential for arbitrary code execution poses a significant risk to organizational data integrity and confidentiality. Furthermore, the vulnerability can be used to cause a denial of service, rendering the management interface inaccessible and disrupting critical network infrastructure.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the router management interface to trusted internal networks only. If possible, disable the affected VPN configuration features until an official firmware update is released by D-Link.

Proactive Monitoring: Review system logs for unusual POST requests directed at the /boafrm/formVpnConfigSetup endpoint, particularly those containing excessively long parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) configured to drop HTTP requests with abnormally large input parameters targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of April 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability and the availability of public proof-of-concept code, immediate action is required to harden the environment. Organizations currently utilizing D-Link DIR-825M routers should isolate these devices from the public internet and verify firmware versions against the vendor's security portal for any incoming updates. Mitigating the attack surface through network segmentation is the most effective temporary measure until a vendor-supplied patch becomes available.

---METADATA---
VENDOR: D-Link
PRODUCT: DI-8100
AFFECTED_VERSIONS: 16.07.26A1
---END_METADATA---

Description Summary:
A remote buffer overflow vulnerability in the D-Link DI-8100 CGI endpoint allows for arbitrary code execution.

Executive Summary:
A critical remote buffer overflow vulnerability in D-Link DI-8100 firmware allows unauthenticated attackers to execute arbitrary code via the CGI interface.

Vulnerability Details

CVE-ID: CVE-2026-7248

Affected Software: D-Link DI-8100

Affected Versions: 16.07.26A1

Vulnerability: The tgfile_htm function within the CGI component fails to properly validate the fn argument, resulting in a buffer overflow that can be triggered remotely by an unauthenticated attacker.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete remote compromise of the affected D-Link device. Attackers can leverage this access to establish persistence, pivot into the internal network, or intercept traffic, creating a high-severity risk to network integrity.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by D-Link to patch the buffer overflow vulnerability.

Proactive Monitoring: Inspect network logs for unusual requests targeting CGI endpoints and monitor for unexpected outbound traffic from the device.

Compensating Controls: Disable remote management of the device and restrict access to the web interface to trusted internal IP addresses using an ACL or firewall.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 28, 2026, a public exploit is available for this vulnerability. Given the ease of remote exploitation, the risk to unpatched devices is extreme.

Analyst Recommendation

Immediate remediation is required as an exploit is publicly available and the device is susceptible to remote code execution. If a patch cannot be immediately applied, the device must be removed from internet-facing segments to prevent compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
D-Link DWR-M961 routers contain a buffer overflow vulnerability in the quicksetup.cgi interface, allowing unauthenticated attackers to execute arbitrary code via crafted input.

Executive Summary:
An unauthenticated remote buffer overflow vulnerability in D-Link DWR-M961 routers allows attackers to achieve arbitrary code execution via the quicksetup.cgi interface.

Vulnerability Details

CVE-ID: CVE-2026-71958

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: The vulnerability is a buffer overflow (CWE-120) within the quicksetup.cgi interface. An unauthenticated attacker can submit overly long strings to the test4, ssid2, or username fields to trigger an overflow and execute arbitrary commands.

Business Impact

The CVSS score of 9.8 underscores the severe impact of this vulnerability, which allows an attacker to bypass authentication and execute code on the device. This could lead to a total loss of confidentiality, integrity, and availability for the affected network segment.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later to resolve the vulnerability.

Proactive Monitoring: Monitor for suspicious web requests targeting the quicksetup.cgi path in the device logs.

Compensating Controls: Limit access to the administrative web interface to trusted management networks to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The accessibility of the quicksetup interface makes it a high-value target for remote attackers.

Analyst Recommendation

Given that this is a critical remote code execution flaw, immediate patching is required. Organizations should ensure all affected D-Link DWR-M961 devices are updated to the latest firmware to eliminate this security risk.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
D-Link DWR-M961 routers are susceptible to a buffer overflow in the app.cgi interface, which allows unauthenticated remote attackers to execute arbitrary commands or crash the device.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DWR-M961 routers permits unauthenticated remote code execution via the app.cgi interface.

Vulnerability Details

CVE-ID: CVE-2026-71957

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: This is a classic buffer overflow (CWE-120) in the app.cgi interface. By sending an excessively long string to the netAcc.addlist[].name field, an unauthenticated attacker can overwrite memory to execute arbitrary code or trigger a system crash.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to network security. Successful exploitation grants an attacker the ability to execute arbitrary code, potentially leading to full control over the router, data exfiltration, or complete network disruption.

Remediation Plan

Immediate Action: Apply the firmware update to version 1.1.5_C1_202607071108 or newer to address the underlying memory safety issue.

Proactive Monitoring: Review system logs for signs of repeated crashes or abnormal process termination, which may indicate attempted exploitation.

Compensating Controls: Implement strict ingress filtering at the network perimeter to prevent unauthorized access to the router's management web interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Buffer overflows of this nature are frequently targeted by attackers once the technical details are disclosed.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Administrators should verify the current firmware version and apply the vendor-provided patch as soon as possible to prevent potential remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
D-Link DWR-M961 routers contain a command injection vulnerability in the app.cgi interface, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers allows unauthenticated attackers to achieve full system compromise with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-71956

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command within the netDig.ping.dst parameter of the app.cgi interface. It permits unauthenticated remote attackers to inject and execute arbitrary system commands.

Business Impact

Successful exploitation grants an attacker root access to the affected router, which can lead to complete loss of network control, interception of traffic, and the potential for lateral movement into the internal network. Given the CVSS score of 9.8, this vulnerability represents a severe threat to business continuity and data confidentiality.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 device firmware to version 1.1.5_C1_202607071108 or later immediately.

Proactive Monitoring: Monitor device logs for unusual process execution or attempts to access the app.cgi interface with malformed parameters.

Compensating Controls: Restrict management access to the router via the local network only and disable WAN-side administrative access to minimize exposure to external actors.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication.

Analyst Recommendation

The severity of this issue necessitates immediate patching. Administrators should prioritize updating all affected D-Link DWR-M961 units to the latest firmware version to mitigate the risk of remote code execution.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
D-Link DWR-M961 routers are vulnerable to command injection in the /boafrm/formWsc interface, enabling unauthenticated remote attackers to execute arbitrary commands as root.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers enables unauthenticated attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-71955

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: This vulnerability arises from improper neutralization of special elements in the localPin, targetAPSsid, peerPin, and peerRptPin fields within the /boafrm/formWsc interface. It allows unauthenticated remote attackers to execute system commands with root-level permissions.

Business Impact

Exploitation of this vulnerability allows full control over the affected hardware, which may result in data exfiltration, the installation of persistent backdoors, or the redirection of network traffic. With a CVSS score of 9.8, this represents a critical risk that could lead to widespread organizational compromise.

Remediation Plan

Immediate Action: Apply the vendor firmware update to version 1.1.5_C1_202607071108 or later to resolve the vulnerability.

Proactive Monitoring: Review system logs for anomalous interactions with the /boafrm/formWsc interface or unexpected system command activity.

Compensating Controls: Ensure that administrative interfaces are not reachable from the public internet and employ firewall rules to limit access to trusted IP ranges.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it lacks any authentication requirement.

Analyst Recommendation

Organizations must move quickly to update the firmware on all D-Link DWR-M961 routers. Failure to patch these devices leaves the network vulnerable to total compromise by remote attackers.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
D-Link DWR-M961 routers contain a command injection vulnerability in the L2TPv3 configuration interface allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
An unauthenticated remote command injection vulnerability in D-Link DWR-M961 routers allows full system compromise via the L2TPv3 configuration interface.

Vulnerability Details

CVE-ID: CVE-2026-71954

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring within the /boafrm/formL2tpv3ConfigSetup interface. An unauthenticated attacker can supply malicious input to the tunnelid and sessionid parameters to execute commands with root-level privileges.

Business Impact

The CVSS score of 9.8 reflects the critical severity of this flaw, as it allows complete takeover of the affected device without requiring authentication. Compromise of network infrastructure devices can lead to unauthorized traffic interception, lateral movement into internal segments, and persistent denial of service, posing a severe risk to organizational network integrity.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later immediately.

Proactive Monitoring: Monitor device logs for unusual activity, specifically looking for attempts to access the L2TPv3 configuration interface from unauthorized IP addresses.

Compensating Controls: Restrict access to the router management interface to trusted administrative IP addresses only, and employ a network firewall to block inbound access to the web management interface from untrusted networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as an unauthenticated command injection makes it highly dangerous if an exploit is developed and released.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, administrators must prioritize the firmware update as an urgent task. If patching is not immediately feasible, ensure that the device management interface is not exposed to the public internet to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formNtp interface allows unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
The D-Link DWR-M961 router contains a critical command injection vulnerability that allows unauthenticated remote attackers to gain complete control over the device at the root level.

Vulnerability Details

CVE-ID: CVE-2026-71953

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is an OS command injection flaw (CWE-78) affecting the /boafrm/formNtp interface. The vulnerability arises from inadequate sanitization of the ntpServerIp1 field, enabling unauthenticated remote attackers to execute arbitrary commands on the host system.

Business Impact

Exploitation of this vulnerability grants the attacker full root access to the affected hardware. This compromises the entire device, allowing for unauthorized network access, data theft, and potential lateral movement into the protected network segments. The CVSS score of 9.8 underscores the critical nature of this vulnerability and the urgent need for mitigation.

Remediation Plan

Immediate Action: Upgrade the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Monitor network traffic and device logs for suspicious activity, particularly any attempts to reach the NTP configuration interface.

Compensating Controls: Implement firewall rules to block traffic to administrative ports from untrusted networks, and utilize network segmentation to limit the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows unauthenticated code execution.

Analyst Recommendation

Administrators must treat this vulnerability with the highest priority. Applying the provided firmware update is the only effective way to remediate this critical security risk and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formPinManageSetup interface allows unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
The D-Link DWR-M961 router is susceptible to a critical command injection vulnerability that permits unauthenticated remote attackers to execute arbitrary code with root-level permissions.

Vulnerability Details

CVE-ID: CVE-2026-71952

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is an OS command injection vulnerability (CWE-78) within the /boafrm/formPinManageSetup interface. Insufficient input validation on the oldPIn field allows an unauthenticated remote attacker to inject and execute system commands.

Business Impact

Successful exploitation allows an attacker to achieve full system compromise, providing them with root access to the underlying operating system. This could lead to data exfiltration, network traffic interception, or the use of the device as a persistent staging point for further attacks on the internal network. The high CVSS score of 9.8 reflects the ease of exploitation and the severity of the impact.

Remediation Plan

Immediate Action: Apply the vendor-supplied firmware update to version 1.1.5_C1_202607071108 or newer as soon as possible.

Proactive Monitoring: Review device logs for unexpected command executions or attempts to access administrative management endpoints from external sources.

Compensating Controls: Disable remote management access to the device and ensure it is only accessible via a secure, isolated management VLAN or VPN.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this security flaw, immediate remediation is required. Security teams should ensure all affected D-Link DWR-M961 devices are patched to the latest firmware version to mitigate the risk of remote command execution.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formIMEISetup interface allows unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
The D-Link DWR-M961 router contains a critical command injection vulnerability that enables unauthenticated remote attackers to gain full root-level control over the device.

Vulnerability Details

CVE-ID: CVE-2026-71951

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is an OS command injection flaw (CWE-78) located in the /boafrm/formIMEISetup interface. The application fails to properly sanitize input in the IMEI_value field, allowing an unauthenticated remote attacker to inject malicious system commands.

Business Impact

A successful exploitation of this vulnerability results in full administrative control over the affected network device. This allows attackers to pivot into internal networks, intercept traffic, or deploy persistent malware. Given the CVSS score of 9.8, the risk to confidentiality, integrity, and availability is extreme, potentially leading to a complete compromise of the network perimeter.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later immediately.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized configuration changes initiated via the web management interface.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and employ a Web Application Firewall to filter malicious input strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as an unauthenticated command injection makes it highly attractive to threat actors.

Analyst Recommendation

This vulnerability represents a critical risk to infrastructure security. Administrators must prioritize the application of the vendor-provided firmware update to eliminate the command injection vector, as failure to do so leaves the device susceptible to total unauthorized control.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formSmsManage interface allows remote unauthenticated attackers to execute arbitrary system commands with root privileges.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to achieve full system compromise with root-level access.

Vulnerability Details

CVE-ID: CVE-2026-71950

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) located in the /boafrm/formSmsManage interface. Attackers can leverage the action_value field to inject arbitrary commands, executing them with root privileges without needing to authenticate.

Business Impact

The CVSS score of 9.8 highlights the critical nature of this flaw, which allows for total compromise of the router. Potential impacts include unauthorized access to internal network segments, surveillance of network communications, and the potential for a complete breakdown of perimeter security.

Remediation Plan

Immediate Action: Update all D-Link DWR-M961 (Hardware C1) devices to firmware version 1.1.5_C1_202607071108 or later.

Proactive Monitoring: Inspect device logs for suspicious SMS management actions or unexpected command-line activity associated with the web service.

Compensating Controls: Implement strict access control lists to prevent external entities from reaching the router management interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The simplicity of the attack vector makes it a high-priority target for automated exploitation if a PoC is eventually released.

Analyst Recommendation

Given that this is one of multiple critical injection vulnerabilities identified in the same device, it is imperative to apply the provided firmware update immediately. Failure to patch leaves the internal network exposed to full remote control by unauthorized actors.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formUSSDSetup interface allows remote unauthenticated attackers to execute arbitrary system commands with root privileges.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to achieve full system compromise with root-level access.

Vulnerability Details

CVE-ID: CVE-2026-71949

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: The /boafrm/formUSSDSetup interface fails to properly sanitize user input, leading to an OS Command Injection vulnerability (CWE-78). Remote unauthenticated attackers can supply malicious input via the ussdValue or selectMenuValue fields to gain root-level command execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to organizational security. Successful exploitation grants an attacker administrative control over the router, facilitating data exfiltration, traffic redirection, or the permanent installation of persistent malware on the gateway device.

Remediation Plan

Immediate Action: Apply the firmware update 1.1.5_C1_202607071108 or newer to all identified D-Link DWR-M961 units.

Proactive Monitoring: Review system logs for unexpected USSD-related configuration changes or anomalous process execution originating from the web management interface.

Compensating Controls: Employ firewall rules to block external access to the device management interface and consider disabling unused features if they cannot be patched immediately.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable as it requires no prior authentication.

Analyst Recommendation

This vulnerability represents a significant risk to network integrity. Security teams should treat this update with high urgency and ensure all hardware C1 devices are brought to the patched firmware version as soon as possible.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formDebugDiagnosticRun interface allows remote unauthenticated attackers to execute arbitrary system commands with root privileges.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to achieve full system compromise with root-level access.

Vulnerability Details

CVE-ID: CVE-2026-71948

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is an OS Command Injection vulnerability (CWE-78) occurring within the /boafrm/formDebugDiagnosticRun interface. The flaw permits an unauthenticated remote attacker to inject malicious inputs into the host field, which the system executes with root privileges.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows for total control over the affected network device. Compromise of an edge router can lead to unauthorized network access, interception of traffic, and the potential for the device to be used as a pivot point for deeper lateral movement within the corporate environment.

Remediation Plan

Immediate Action: Update the firmware of all affected D-Link DWR-M961 (Hardware C1) devices to version 1.1.5_C1_202607071108 or later immediately.

Proactive Monitoring: Monitor network traffic and system logs for unusual diagnostic requests or suspicious shell execution patterns directed at the device administration interface.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses only, and ensure the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the affected interface.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for complete device takeover, organizations must prioritize patching all affected routers. If immediate patching is not feasible, ensure the management interface is isolated from external networks to prevent remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 router allows unauthenticated remote attackers to execute arbitrary commands with root privileges via the traceroute interface.

Executive Summary:
D-Link DWR-M961 routers are susceptible to unauthenticated remote command injection, which can lead to complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-71947

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is a command injection flaw (CWE-78) located in the /boafrm/formTracerouteDiagnosticRun interface. An unauthenticated attacker can inject arbitrary commands into the host and ipVer fields, leading to command execution with root-level privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to the business, as an attacker could gain full control over the router. This could result in unauthorized network interception, data exfiltration, or the establishment of a persistent foothold within the enterprise network.

Remediation Plan

Immediate Action: Update the affected D-Link DWR-M961 devices to firmware version 1.1.5_C1_202607071108 or later.

Proactive Monitoring: Inspect traffic logs for suspicious strings or characters commonly used in command injection attacks directed at diagnostic endpoints.

Compensating Controls: Restrict access to the web administration panel to trusted management subnets and implement network-level egress filtering to prevent unauthorized callbacks from compromised devices.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ease of triggering this command injection via public-facing diagnostic interfaces makes it a high-priority target for automated exploit attempts.

Analyst Recommendation

This security flaw must be addressed immediately to prevent potential exploitation. Organizations should ensure that all routers are patched to the specified firmware version to eliminate the risk posed by this command injection vulnerability.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 router allows unauthenticated remote attackers to execute arbitrary commands with root privileges via the host parameter in the ping interface.

Executive Summary:
D-Link DWR-M961 routers contain a critical command injection vulnerability that permits unauthenticated remote code execution with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-71946

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is a command injection flaw (CWE-78) within the /boafrm/formPingDiagnosticRun interface. An unauthenticated attacker can supply malicious input to the host field, resulting in the execution of arbitrary commands with root privileges on the underlying operating system.

Business Impact

The severity of this issue is reflected in the 9.8 CVSS score, indicating a high potential for total system compromise. An attacker could leverage this access to intercept sensitive data, modify network configurations, or launch attacks against other devices within the local network environment.

Remediation Plan

Immediate Action: Apply the vendor-supplied firmware update to version 1.1.5_C1_202607071108 or later.

Proactive Monitoring: Review system and firewall logs for anomalous activity involving diagnostic interface calls or unexpected shell command patterns.

Compensating Controls: Disable remote access to the diagnostic tools if possible, and ensure the router is protected by a strong firewall policy that limits access to the web management interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable as it requires no authentication to reach the affected diagnostic function.

Analyst Recommendation

This vulnerability represents a significant security risk to the integrity and confidentiality of the network. Administrators should prioritize applying the firmware update across all affected D-Link DWR-M961 units to mitigate the risk of remote command injection.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: Hardware version C1, firmware versions before 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 router allows unauthenticated remote attackers to execute arbitrary commands with root privileges via the fota_url parameter.

Executive Summary:
D-Link DWR-M961 routers are vulnerable to unauthenticated remote command injection, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-71945

Affected Software: D-Link DWR-M961

Affected Versions: Hardware version C1, firmware versions before 1.1.5_C1_202607071108

Vulnerability: This is a command injection flaw (CWE-78) located in the /boafrm/formLtefotaUpgradeFibocom interface. The vulnerability allows an unauthenticated remote attacker to inject malicious commands into the fota_url field, which are then executed by the system with root-level privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker complete control over the affected router. Given the CVSS score of 9.8, this is a critical risk that could lead to unauthorized access to internal network traffic, credential theft, or the use of the device as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later immediately.

Proactive Monitoring: Monitor network logs for unusual outbound traffic or requests directed at the /boafrm/ directory, as these may indicate attempted exploitation.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and employ a Web Application Firewall to block suspicious input patterns in URL parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication requirements and the resulting root-level execution.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for total device takeover, all affected hardware must be updated to the patched firmware version as a priority. If immediate patching is not feasible, ensure the device management interface is not exposed to the public internet.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M961
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5_C1_202607071108
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DWR-M961 /boafrm/formLtefotaUpgradeQuectel interface allows unauthenticated remote attackers to execute arbitrary commands as root.

Executive Summary:
A critical command injection vulnerability in D-Link DWR-M961 routers allows remote, unauthenticated attackers to execute arbitrary code with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-71944

Affected Software: D-Link DWR-M961

Affected Versions: 0 up to (excluding) 1.1.5_C1_202607071108

Vulnerability: The vulnerability exists in the /boafrm/formLtefotaUpgradeQuectel interface, which fails to sanitize the fota_url parameter (CWE-78). This allows an unauthenticated remote attacker to inject malicious commands that are then executed by the system with root-level permissions.

Business Impact

The CVSS score of 9.8 highlights the severity of this issue. Compromise of the DWR-M961 router provides an attacker with a foothold in the local network, potentially facilitating man-in-the-middle attacks, data theft, and long-term persistence within the enterprise environment.

Remediation Plan

Immediate Action: Update the D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later to resolve the injection flaw.

Proactive Monitoring: Monitor network logs for unusual requests directed toward the FOTA (Firmware Over-The-Air) upgrade interface.

Compensating Controls: Use a network-level firewall or Access Control List (ACL) to restrict access to the device management interface to authorized management subnets only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe due to the lack of required authentication for the affected interface.

Analyst Recommendation

All organizations utilizing D-Link DWR-M961 hardware must prioritize upgrading to firmware version 1.1.5_C1_202607071108. The ease of remote execution without authentication makes this a critical risk that must be addressed immediately to maintain network security.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825
AFFECTED_VERSIONS: 3.00b32
CONFIDENCE: high
MISSING: patch
CREDITS: tian (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359644","name":"VDB-359644 | D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359644/cti","name":"VDB-359644 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798647","name":"Submit #798647 | D-Link DIR-825 C1_FW3.00b32 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://tzh00203.notion.site/D-Link-DIR-825-miniupnpd-AddPortMapping-Stack-Overflow-337b5c52018a8028988ecc9daded409e","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the miniupnpd component of D-Link DIR-825 routers allows local network attackers to potentially achieve memory corruption via the AddPortMapping function.

Executive Summary:
A buffer overflow vulnerability in the D-Link DIR-825 router, affecting the AddPortMapping function, poses a significant risk of remote code execution for attackers on the local network.

Vulnerability Details

CVE-ID: CVE-2026-7069

Affected Software: D-Link DIR-825

Affected Versions: 3.00b32

Vulnerability: This is a buffer overflow vulnerability (CWE-120) located in the AddPortMapping function within the miniupnpd component. An attacker with low-level privileges on the local network can trigger memory corruption by manipulating the NewPortMappingDescription argument.

Business Impact

Successful exploitation of this buffer overflow could result in unauthorized code execution, leading to a complete compromise of the router. Given the CVSS score of 8.0, this represents a high-severity risk that could allow attackers to intercept traffic, pivot into the internal network, or permanently disrupt connectivity for business operations.

Remediation Plan

Immediate Action: As the affected hardware is no longer supported by the vendor, users should immediately decommission the device or isolate it from the network if an upgrade to a currently supported model is not immediately possible.

Proactive Monitoring: Monitor local network traffic for unusual UPnP requests or unexpected spikes in traffic directed at the router management interface.

Compensating Controls: Disable UPnP globally on the device and implement strict network segmentation to ensure that only trusted devices can access the router management layer.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the vulnerability references.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of stack-based buffer overflows in legacy firmware.

Analyst Recommendation

Due to the end-of-life status of the D-Link DIR-825 and the availability of a public proof-of-concept, this vulnerability poses a persistent and unpatchable risk. Organizations must prioritize the replacement of this hardware with modern, supported networking equipment to maintain a secure perimeter and prevent potential unauthorized access to the internal network.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-825
AFFECTED_VERSIONS: 3.00b32
CONFIDENCE: high
MISSING: patch
CREDITS: tian (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359643","name":"VDB-359643 | D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359643/cti","name":"VDB-359643 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798646","name":"Submit #798646 | D-Link DIR-825 C1_FW3.00b32 C1_FW3.00b32 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://tzh00203.notion.site/D-Link-DIR-825-nmbd-NetBIOS-Name-Service-Stack-Based-Buffer-Overflow-337b5c52018a80cea1e8d56689928114","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the nmbd component of D-Link DIR-825 version 3.00b32 allows local network attackers to potentially execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-825 devices poses a severe risk of memory corruption and potential code execution for local network users.

Vulnerability Details

CVE-ID: CVE-2026-7068

Affected Software: D-Link DIR-825

Affected Versions: 3.00b32

Vulnerability: This vulnerability is a buffer overflow within the NMBD_process function of the nmbd component, which can be triggered by an unauthenticated attacker located on the local network.

Business Impact

The exploitation of this memory corruption vulnerability allows an attacker to achieve total technical impact, potentially leading to unauthorized control of the affected networking hardware. Given the CVSS score of 8.8, this flaw represents a significant risk to network integrity. Because the device is no longer supported by the vendor, organizations relying on this hardware face permanent exposure to this flaw, which may facilitate lateral movement or network interception within the local segment.

Remediation Plan

Immediate Action: As the affected hardware is no longer supported by D-Link, the most effective remediation is to retire and replace the device with a modern, vendor-supported alternative.

Proactive Monitoring: Monitor local network traffic for anomalous NetBIOS Name Service requests or unusual spikes in traffic directed toward the nmbd service.

Compensating Controls: Isolate the affected devices on a restricted management VLAN or behind a robust firewall to prevent unauthorized local network access to the vulnerable service.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced by the CVE record.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of memory safety in the processing of NetBIOS requests.

Analyst Recommendation

Due to the end-of-life status of the D-Link DIR-825, no official patch will be released to address this vulnerability. Security teams must prioritize the immediate decommissioning of these devices to eliminate the risk of remote code execution. Continued operation of this hardware within a production environment is strongly discouraged and presents an unacceptable security posture for the organization.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-822
AFFECTED_VERSIONS: A_101
CONFIDENCE: high
MISSING: patch
CREDITS: tian (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359642","name":"VDB-359642 | D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359642/cti","name":"VDB-359642 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798645","name":"Submit #798645 | D-Link DIR822A_101 A_101 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://tzh00203.notion.site/D-Link-DIR-822-A1-Command-Injection-in-udhcpd-via-DHCP-Hostname-337b5c52018a80d9b638d0fa59969e6b","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.723Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the D-Link DIR-822 DHCP service allows remote, unauthenticated attackers to execute arbitrary system commands via the Hostname parameter.

Executive Summary:
The D-Link DIR-822 router is vulnerable to remote command injection, which allows unauthenticated attackers to execute arbitrary code on the device.

Vulnerability Details

CVE-ID: CVE-2026-7067

Affected Software: D-Link DIR-822

Affected Versions: A_101

Vulnerability: This vulnerability is a command injection flaw (CWE-77) located in the system function of the udhcpd DHCP service. An unauthenticated attacker can trigger this by sending a malicious Hostname argument to the device.

Business Impact

The exploitation of this vulnerability permits unauthorized code execution on the router, which can lead to complete device compromise, unauthorized network access, and interception of local traffic. Given the CVSS score of 7.3, this represents a high risk to network integrity, especially as it allows remote access without requiring any user authentication.

Remediation Plan

Immediate Action: As the affected hardware is no longer supported by the manufacturer, the primary remediation is to decommission the device or replace it with a currently supported model.

Proactive Monitoring: Network administrators should monitor traffic for unusual DHCP handshake patterns or unexpected outbound connections originating from the router management interface.

Compensating Controls: If immediate replacement is not possible, isolate the affected router on a restricted network segment and disable the DHCP service if the device functionality allows, though this will not fully eliminate the risk of hardware-level compromise.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability researcher.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its reachability over the network and the lack of authentication required to trigger the injection.

Analyst Recommendation

Due to the end-of-life status of the D-Link DIR-822 and the presence of a functional proof-of-concept, this device poses an unacceptable risk to any network environment. Organizations should prioritize the immediate retirement of this hardware to prevent potential remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWM-222W USB Wi-Fi Adapter
AFFECTED_VERSIONS: D-Link DWM-222W: 0 up to (excluding) 1.02.00
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.twcert.org.tw/tw/cp-132-10864-944b1-1.html","name":null,"tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10865-de323-2.html","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.531Z
---END_METADATA---

Description Summary:
The D-Link DWM-222W USB Wi-Fi Adapter contains a brute-force protection bypass vulnerability, which allows unauthenticated attackers to circumvent login attempt limits and compromise the device.

Executive Summary:
A critical authentication bypass flaw in the D-Link DWM-222W USB Wi-Fi Adapter allows unauthenticated attackers to perform brute-force attacks and gain administrative control over the device.

Vulnerability Details

CVE-ID: CVE-2026-6947

Affected Software: D-Link DWM-222W

Affected Versions: D-Link DWM-222W: 0 up to (excluding) 1.02.00

Vulnerability: The device fails to properly restrict excessive authentication attempts, enabling an unauthenticated attacker on an adjacent network to bypass login protections. This flaw allows the attacker to repeatedly attempt credentials until gaining unauthorized access.

Business Impact

Successful exploitation of this vulnerability could lead to a complete loss of device confidentiality and integrity, as an attacker gaining control of a network adapter can potentially intercept or manipulate traffic. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to network security, potentially allowing unauthorized actors to pivot into the internal network environment.

Remediation Plan

Immediate Action: Update the device firmware to version 1.02.00 or later as provided by the vendor.

Proactive Monitoring: Monitor device access logs for recurring failed login attempts or unusual administrative activity that may indicate a brute-force attack in progress.

Compensating Controls: Ensure the device is placed on an isolated management network and restrict access to the administrative interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its nature as an unauthenticated, automatable attack vector that requires minimal complexity to execute.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized device takeover. Administrators should verify the current firmware version of all deployed DWM-222W units and apply the 1.02.00 patch immediately to close the authentication bypass window and secure the device against brute-force attempts.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356570","name":"VDB-356570 | D-Link DIR-513 POST Request formAdvanceSetup buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356570/cti","name":"VDB-356570 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791860","name":"Submit #791860 | D-Link DIR-513 D-Link DIR-513 A2 1.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-513-formAdvanceSetup-33153a41781f80829d47ec9b86dd8abf?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-513 formAdvanceSetup function allows remote attackers to trigger memory corruption via a malicious POST request.

Executive Summary:
A remote buffer overflow vulnerability in D-Link DIR-513 firmware poses a critical risk of unauthorized system control due to the lack of an available security patch.

Vulnerability Details

CVE-ID: CVE-2026-6014

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The flaw exists within the formAdvanceSetup function located in the /goform/formAdvanceSetup component. An attacker can trigger a buffer overflow by sending a crafted POST request to the device, which may result in arbitrary code execution or system instability.

Business Impact

The CVSS score of 8.8 reflects a high potential for severe system compromise, including the possibility of remote code execution. Because this device is confirmed to be end-of-life and no longer supported, the risk of permanent, unpatchable exposure is extreme, potentially leading to unauthorized network access or total device takeover.

Remediation Plan

Immediate Action: As the vendor no longer provides security updates for this model, the only effective remediation is to decommission and replace the affected D-Link DIR-513 hardware with a currently supported device.

Proactive Monitoring: Monitor network traffic for suspicious POST requests targeting the /goform/ directory and observe devices for unexpected reboots or service interruptions that may indicate exploitation attempts.

Compensating Controls: If immediate replacement is not feasible, isolate the device from the internet via a firewall, ensure that management interfaces are not exposed to the public, and implement strict access control lists to limit administrative traffic.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to remote actors, and the lack of vendor support significantly elevates the long-term risk profile.

Analyst Recommendation

Given the confirmed existence of a public proof-of-concept and the lack of official vendor patches, organizations must prioritize the immediate retirement of the D-Link DIR-513. Continued operation of this hardware presents an unacceptable security risk that cannot be mitigated through configuration changes alone.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356569","name":"VDB-356569 | D-Link DIR-513 POST Request formSetRoute buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356569/cti","name":"VDB-356569 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791859","name":"Submit #791859 | D-Link DIR-513 D-Link DIR-513 A2 1.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-513-formSetRoute-33153a41781f80f7aed1d3614c199d85?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-513 POST request handler allows remote attackers to trigger memory corruption via the curTime argument.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DIR-513 router allows for remote code execution and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6013

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: This vulnerability involves a buffer overflow in the formSetRoute function within the /goform/formSetRoute component. Attackers with low-level privileges can trigger this memory corruption remotely by manipulating the curTime argument in a crafted POST request.

Business Impact

Successful exploitation of this buffer overflow can lead to complete system compromise, allowing an attacker to execute arbitrary code or cause a denial of service condition. Given the CVSS score of 8.8, this vulnerability poses a significant risk to network integrity and confidentiality, particularly as the device is no longer supported by the vendor, meaning no official security patches will be issued.

Remediation Plan

Immediate Action: Since this device is end-of-life and no patch is available, immediately isolate the affected hardware from the public internet or replace it with a currently supported device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetRoute endpoint and watch for unexpected device reboots or instability.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface, ensuring it is only accessible from trusted internal management subnets.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the vulnerability disclosure.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the nature of buffer overflows in network-facing components.

Analyst Recommendation

Due to the lack of vendor support and the availability of public proof-of-concept code, this device represents a severe security liability. Administrators should prioritize the decommissioning of the D-Link DIR-513 in favor of modern, supported networking equipment to ensure adequate protection against remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356568","name":"VDB-356568 | D-Link DIR-513 POST Request formSetPassword buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356568/cti","name":"VDB-356568 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791858","name":"Submit #791858 | D-Link DIR-513 D-Link DIR-513 A2 1.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-513-formSetPassword-33153a41781f806e9a3cf63a5a9091ac?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the formSetPassword function of D-Link DIR-513 allows remote attackers to trigger memory corruption via the curTime argument.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DIR-513 router allows for remote code execution, posing a significant risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-6012

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: This vulnerability is a buffer overflow (CWE-120) located within the formSetPassword function of the POST request handler. An authenticated attacker can trigger this memory corruption remotely by manipulating the curTime argument.

Business Impact

Successful exploitation of this vulnerability can lead to a complete compromise of the affected router, potentially allowing an attacker to gain unauthorized control over network traffic. Given the high CVSS score of 8.8, this represents a severe threat to confidentiality, integrity, and availability within the local network. Organizations relying on this end of life hardware face elevated risks, as the vendor no longer provides security updates for the device.

Remediation Plan

Immediate Action: Since the vendor has confirmed this product is no longer supported, the primary remediation is to retire and replace the affected hardware with a current, supported device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetPassword endpoint and investigate any unexpected device reboots or service instability.

Compensating Controls: Implement strict network segmentation to isolate the vulnerable device from critical segments and deploy a Web Application Firewall or Intrusion Prevention System to detect and block malicious payloads targeting buffer overflow patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept is available via the technical write-up referenced at the provided Notion security research link.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per the technical documentation and CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its nature as a memory corruption vulnerability in an unpatched, end of life product.

Analyst Recommendation

The D-Link DIR-513 is legacy hardware that no longer receives security maintenance, making it a permanent liability in any production environment. We strongly recommend immediate decommissioning of these devices to prevent potential remote exploitation. If immediate replacement is not feasible, restrict administrative access to the device to the absolute minimum number of trusted internal hosts and monitor all associated traffic for signs of compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356538","name":"VDB-356538 | D-Link DIR-605L POST Request formSetLog buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356538/cti","name":"VDB-356538 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791857","name":"Submit #791857 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetLog-33153a41781f8038bbbcc04073d7875b?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-605L router allows remote attackers to trigger memory corruption via the formSetLog function.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DIR-605L router, version 2.13B01, poses a severe risk of remote code execution and total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5984

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: The vulnerability exists within the formSetLog function, located at the /goform/formSetLog endpoint. An authenticated attacker can trigger a buffer overflow by manipulating the curTime argument in a crafted POST request.

Business Impact

The exploitation of this memory corruption flaw can lead to a complete compromise of the affected router, potentially allowing an attacker to gain unauthorized control over network traffic. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could facilitate lateral movement within the network, data exfiltration, or total denial of service for critical infrastructure relying on this device.

Remediation Plan

Immediate Action: Because the product is no longer supported by the manufacturer, there is no official security patch available. Organizations should immediately retire or replace this device with a supported, secure alternative.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/formSetLog path and look for unusual administrative activity or sudden device reboots.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion prevention system to filter and block malicious traffic targeting the vulnerable endpoint, though this should only be considered a temporary stopgap.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The inherent nature of buffer overflow vulnerabilities makes this device highly susceptible to remote code execution if reachable from the network.

Analyst Recommendation

The D-Link DIR-605L is currently end-of-life and lacks vendor support, meaning no patch will be provided for this critical flaw. Given the existence of a public proof-of-concept and the potential for total system compromise, immediate decommissioning of this hardware is strongly advised to maintain the security posture of the network environment.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356537","name":"VDB-356537 | D-Link DIR-605L POST Request formSetDDNS buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356537/cti","name":"VDB-356537 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791856","name":"Submit #791856 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetDDNS-33153a41781f802f9997f48dc9cf6304?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.911Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-605L formSetDDNS function allows remote attackers to trigger memory corruption via the curTime argument.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DIR-605L router, specifically within the formSetDDNS function, poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5983

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: The vulnerability is a buffer overflow (CWE-120) occurring in the formSetDDNS function within the /goform/formSetDDNS endpoint. An authenticated attacker can trigger memory corruption by manipulating the curTime argument in a POST request.

Business Impact

The exploitation of this buffer overflow could lead to unauthorized remote code execution, potentially resulting in full system compromise of the affected network device. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate lateral movement into the internal network or the interception of traffic. Because the product is no longer supported by the vendor, the lack of official security patches significantly increases the long-term operational risk.

Remediation Plan

Immediate Action: As the affected product is end-of-life and no security update is available, the primary remediation is to decommission the device and replace it with a currently supported model.

Proactive Monitoring: Review network access logs for anomalous POST requests directed at the /goform/formSetDDNS endpoint and monitor for unexpected device reboots or instability which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or network intrusion detection system to filter or block malicious POST requests containing oversized payloads in the curTime parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public technical write-up detailing the attack vector makes this vulnerability highly accessible to threat actors.

Analyst Recommendation

Given the lack of vendor support for the DIR-605L, this vulnerability will remain unpatched indefinitely. Organizations currently utilizing this hardware must prioritize its replacement with a secure, vendor-supported alternative to mitigate the risk of remote compromise and persistent network threats.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356536","name":"VDB-356536 | D-Link DIR-605L POST Request formAdvNetwork buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356536/cti","name":"VDB-356536 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791855","name":"Submit #791855 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formAdvNetwork-33153a41781f80f9a47bd5e073fc00ae?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.915Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the D-Link DIR-605L router, specifically within the formAdvNetwork function, which can be triggered via a crafted POST request.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DIR-605L router allows for remote code execution via a manipulated network parameter.

Vulnerability Details

CVE-ID: CVE-2026-5982

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: This flaw is a buffer overflow (CWE-120) occurring in the formAdvNetwork function of the POST request handler, triggered by manipulating the curTime argument. The vulnerability requires low privileges (authenticated) to execute, as indicated by the CVSS vector.

Business Impact

Successful exploitation allows an attacker to achieve remote code execution on the affected router. Given the CVSS score of 8.8, this poses a severe risk of total system compromise, potentially enabling attackers to intercept network traffic, pivot into internal segments, or persistently control the device. Because the product is no longer supported, the risk of unpatched compromise is extreme.

Remediation Plan

Immediate Action: As the affected hardware is end-of-life and no vendor patch is available, immediately isolate the device from external network exposure or replace it with a currently supported model.

Proactive Monitoring: Monitor network access logs for suspicious POST requests directed at the /goform/formAdvNetwork URI, particularly those containing abnormally long strings in the curTime parameter.

Compensating Controls: Implement strict firewall rules to restrict access to the router management interface to trusted internal IP addresses only, and disable remote management features if they are not strictly necessary.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of memory protections in the legacy firmware.

Analyst Recommendation

This vulnerability represents a significant security risk for the D-Link DIR-605L, which is no longer receiving security updates from the manufacturer. Organizations currently utilizing this hardware should prioritize its immediate decommissioning and replacement to eliminate the risk of remote compromise. If immediate replacement is not feasible, restrict access to the device to the absolute minimum level possible to mitigate the attack surface.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356535","name":"VDB-356535 | D-Link DIR-605L POST Request formAdvFirewall buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356535/cti","name":"VDB-356535 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791854","name":"Submit #791854 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formAdvFirewall-33153a41781f80678733f4b12282f3fa?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["broken-link","product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.915Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-605L POST request handler allows remote attackers to trigger memory corruption via the curTime argument.

Executive Summary:
A remote buffer overflow vulnerability in D-Link DIR-605L devices poses a high risk of total system compromise, though official patches are unavailable as the product has reached end of life.

Vulnerability Details

CVE-ID: CVE-2026-5981

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: The vulnerability exists within the formAdvFirewall function of the /goform/formAdvFirewall endpoint. An authenticated attacker can trigger a buffer overflow by sending a crafted POST request containing a malicious curTime argument, leading to memory corruption.

Business Impact

Successful exploitation of this vulnerability results in total system compromise, potentially allowing an attacker to execute arbitrary code or cause a denial of service. With a CVSS score of 8.8, this flaw represents a significant risk to network integrity and confidentiality, particularly in environments where these legacy devices remain in operation.

Remediation Plan

Immediate Action: As the vendor no longer supports this device, there is no official patch available; the most secure action is to decommission and replace the affected hardware immediately.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/formAdvFirewall endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface, ensuring it is not reachable from the public internet or untrusted network segments.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the referenced security researcher write-up.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The technical details regarding the vulnerable parameter and endpoint are publicly documented, lowering the barrier for potential attackers.

Analyst Recommendation

Given the lack of vendor support and the availability of a public proof-of-concept, the risk associated with this vulnerability is severe. Organizations currently utilizing D-Link DIR-605L devices are strongly advised to remove them from the network environment to prevent potential compromise, as no software update will be provided to mitigate this flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356534","name":"VDB-356534 | D-Link DIR-605L POST Request formSetMACFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356534/cti","name":"VDB-356534 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791853","name":"Submit #791853 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetMACFilter-33153a41781f807c8fb4c3a75f7b555e?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.915Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the D-Link DIR-605L router due to improper handling of the curTime argument in the formSetMACFilter function.

Executive Summary:
A remote buffer overflow vulnerability in D-Link DIR-605L version 2.13B01 poses a critical risk of total system compromise as the device has reached end-of-life status.

Vulnerability Details

CVE-ID: CVE-2026-5980

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: This vulnerability is a buffer overflow (CWE-120) triggered by sending a crafted POST request to the /goform/formSetMACFilter endpoint. The attack requires low-level privileges (authenticated user) to manipulate the curTime parameter, potentially leading to arbitrary code execution.

Business Impact

The exploitation of this vulnerability allows an attacker to achieve total system compromise, potentially leading to unauthorized network access, data exfiltration, or complete loss of router availability. Given the CVSS score of 8.8, this flaw represents a high-severity risk. Because the product is no longer supported by the vendor, there will be no official security patches, which significantly increases the long-term operational risk to the environment.

Remediation Plan

Immediate Action: Since this device is end-of-life and no patch will be provided, immediately decommission and replace the affected D-Link DIR-605L hardware with a currently supported model.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/formSetMACFilter endpoint and review device logs for signs of unauthorized configuration changes or unexpected reboots.

Compensating Controls: If the device cannot be immediately retired, place it behind an isolated network segment and implement strict access control lists to limit administrative access to only known, trusted internal IP addresses.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of modern memory protections in this legacy firmware.

Analyst Recommendation

The severity of this vulnerability, combined with the fact that D-Link no longer provides security updates for the DIR-605L, necessitates an immediate transition away from this hardware. Organizations must prioritize the replacement of these devices to maintain a secure network perimeter, as they are now inherently vulnerable to remote exploitation without any path to remediation.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: 2.13B01
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356533","name":"VDB-356533 | D-Link DIR-605L POST Request formVirtualServ buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356533/cti","name":"VDB-356533 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791852","name":"Submit #791852 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formVirtualServ-33153a41781f80b496e1de206077bc7e?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.915Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the D-Link DIR-605L router allows remote attackers to trigger memory corruption via the formVirtualServ function.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-605L routers poses a severe risk of remote code execution, though exploitation requires low-level authentication.

Vulnerability Details

CVE-ID: CVE-2026-5979

Affected Software: D-Link DIR-605L

Affected Versions: 2.13B01

Vulnerability: The vulnerability exists within the formVirtualServ function of the /goform/formVirtualServ endpoint, where improper handling of the curTime argument leads to a buffer overflow. This memory corruption flaw can be triggered remotely by an authenticated attacker with low-level privileges.

Business Impact

The CVSS score of 8.8 reflects the high severity of this memory corruption flaw, which could lead to full system compromise or denial of service. Because the affected device is end-of-life and no longer supported, the risk of permanent vulnerability is high, potentially exposing internal network segments to unauthorized access and lateral movement.

Remediation Plan

Immediate Action: As this product is no longer supported by the vendor, the immediate action is to retire the hardware and replace it with a currently supported device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formVirtualServ endpoint and review device logs for signs of abnormal crashes or unexpected reboots.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) to restrict access to the device management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the affected parameter.

Analyst Recommendation

Given that D-Link has officially ended support for the DIR-605L, no patch will be forthcoming. Organizations still utilizing this hardware must prioritize its decommissioning to mitigate the risk of remote exploitation. Continued use of this device in a production environment is strongly discouraged as it remains permanently susceptible to this buffer overflow flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-645
AFFECTED_VERSIONS: 1.01, 1.02, 1.03
CONFIDENCE: high
MISSING: none
CREDITS: Pers1st (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/356263","name":"VDB-356263 | D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356263/cti","name":"VDB-356263 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/788298","name":"Submit #788298 | D-Link DIR-645 1.01–1.03 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Pers1st0/CVE/blob/main/stack-based%20buffer%20overflow%20vulnerability%20exists%20in%20the%20hedwig.cgi%20of%20D-Link%20DIR-645.md","name":null,"tags":["related"]},{"url":"https://github.com/Pers1st0/CVE/blob/main/stack-based%20buffer%20overflow%20vulnerability%20exists%20in%20the%20hedwig.cgi%20of%20D-Link%20DIR-645.md#poc","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.939Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the hedwigcgi_main function of D-Link DIR-645 allows remote attackers to achieve remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DIR-645 routers enables remote code execution and full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-5815

Affected Software: D-Link DIR-645

Affected Versions: 1.01, 1.02, 1.03

Vulnerability: The vulnerability exists within the hedwigcgi_main function of the /cgi-bin/hedwig.cgi file, where improper length checks during the processing of HTTP requests allow a stack-based buffer overflow. This flaw can be triggered by a remote attacker with low privileges by supplying a crafted session identifier.

Business Impact

Successful exploitation of this vulnerability allows an attacker to hijack the execution flow of the router, leading to arbitrary remote code execution. This grants the attacker full control over the affected network device, potentially facilitating unauthorized network access, data interception, and persistence within the local environment. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and confidentiality of the internal network.

Remediation Plan

Immediate Action: Since the vendor has designated this product as end-of-life and no patch is available, the primary remediation is to decommission the device and replace it with a currently supported model.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /cgi-bin/hedwig.cgi endpoint, which may indicate attempts to exploit this buffer overflow.

Compensating Controls: If immediate replacement is not feasible, isolate the device behind a robust firewall and restrict access to the web management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of April 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the session identifier.

Analyst Recommendation

The D-Link DIR-645 is an aging device that no longer receives security updates, making it inherently vulnerable to sophisticated attacks. Organizations still utilizing this hardware should prioritize its immediate replacement, as no software patch will be issued to mitigate this critical remote code execution flaw. Continued use of this device constitutes an unacceptable security risk to the organization.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-1253
AFFECTED_VERSIONS: D-Link DIR-1253 v.1.0.1.250923.142435
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in D-Link DIR-1253 allows unauthenticated attackers to manipulate the etc/shadow component file to gain unauthorized system access.

Executive Summary:
A critical privilege escalation vulnerability in D-Link DIR-1253 firmware allows unauthenticated attackers to compromise the system, posing a severe security risk.

Vulnerability Details

CVE-ID: CVE-2026-52533

Affected Software: D-Link DIR-1253

Affected Versions: D-Link DIR-1253 v.1.0.1.250923.142435

Vulnerability: This is a privilege escalation vulnerability involving the etc/shadow component file. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector PR:N.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows an attacker to gain elevated privileges on the affected device, potentially leading to total system compromise, unauthorized data access, and the ability to execute arbitrary commands. This poses a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Update the device firmware to the latest version as specified in the vendor security bulletin.

Proactive Monitoring: Monitor device access logs for unauthorized administrative logins or suspicious file modification attempts involving system configuration files.

Compensating Controls: Ensure the management interface of the device is not exposed to the public internet and restrict access to trusted internal IP addresses.

Exploitation Status

Public Exploit Available: Yes, a public Proof-of-Concept exists per the provided references.

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation and critical impact.

Analyst Recommendation

Given the critical CVSS score and the availability of proof-of-concept code, this vulnerability requires immediate attention. Administrators must prioritize applying the latest firmware update provided by D-Link to mitigate the risk of unauthorized privilege escalation and system takeover.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS (Network Attached Storage)
AFFECTED_VERSIONS: Firmware up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354349","name":"VDB-354349 | D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354349/cti","name":"VDB-354349 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780439","name":"Submit #780439 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_169/169.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in D-Link NAS devices allows remote authenticated attackers to execute arbitrary code via the name parameter in the cgi_addgroup_get_group_quota_minsize function.

Executive Summary:
A stack-based buffer overflow vulnerability in multiple D-Link NAS devices poses a high risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-5214

Affected Software: D-Link NAS Devices (including DNS-120, DNS-320, DNS-320L, and others)

Affected Versions: Firmware up to 20260205

Vulnerability: The vulnerability exists in the cgi_addgroup_get_group_quota_minsize function within the account_mgr.cgi script. An attacker with low-level privileges can provide a maliciously crafted name parameter that overflows the stack, potentially leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full control over the affected NAS device. This could lead to the complete compromise of stored data, unauthorized access to network resources, and total loss of device availability. Given the CVSS score of 8.8, this represents a significant threat to internal data integrity and system reliability.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch. Administrators should immediately restrict access to the web management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at cgi-bin/account_mgr.cgi, particularly those containing abnormally long strings in the name parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing oversized parameters aimed at the account_mgr.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up linked in the CVE references.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform boundary checks on user-supplied input before copying it to a local stack variable.

Analyst Recommendation

Given the severity of this remote code execution flaw and the availability of public proof-of-concept code, this issue must be treated as a high priority. Until D-Link releases a firmware update, organizations must implement strict network segmentation to isolate affected NAS units from untrusted networks and monitor all management traffic for signs of attempted exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS and DNR Network Attached Storage (NAS) devices
AFFECTED_VERSIONS: Up to and including 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354350","name":"VDB-354350 | D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354350/cti","name":"VDB-354350 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780437","name":"Submit #780437 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_168/168.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the cgi_adduser_to_session function of /cgi-bin/account_mgr.cgi allows remote authenticated attackers to execute arbitrary code via the read_list parameter.

Executive Summary:
A critical stack-based buffer overflow in various D-Link NAS devices allows remote authenticated attackers to compromise system integrity or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5213

Affected Software: D-Link DNS and DNR series NAS devices

Affected Versions: All versions up to and including 20260205

Vulnerability: The vulnerability exists in the cgi_adduser_to_session function within the account_mgr.cgi binary, which fails to perform boundary checks on the read_list, write_list, and decline_list parameters. An authenticated attacker can trigger a stack-based buffer overflow by sending a specially crafted HTTP POST request, potentially resulting in remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected NAS hardware with elevated privileges. This poses a severe risk of data exfiltration, unauthorized access to stored files, or total system compromise. Given the high CVSS score of 8.8, this vulnerability represents a significant threat to operational continuity and data confidentiality.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Users should restrict administrative access to these devices to trusted internal networks only and disable remote management interfaces if they are exposed to the public internet.

Proactive Monitoring: Monitor network traffic and web server access logs for anomalous HTTP POST requests directed at /cgi-bin/account_mgr.cgi, particularly those containing abnormally long strings in the specified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules designed to detect and block oversized input strings directed at the vulnerable account_mgr.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no complex bypasses once the attacker has authenticated.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, even in the absence of a vendor-supplied patch. Administrators must prioritize isolating these devices from external networks to prevent remote exploitation. Once D-Link releases a firmware update, it should be tested and deployed across all affected units as a matter of urgency to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS devices (various models)
AFFECTED_VERSIONS: Firmware up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354348","name":"VDB-354348 | D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354348/cti","name":"VDB-354348 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780435","name":"Submit #780435 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/780436","name":"Submit #780436 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_166/166.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Webdav_Upload_File function of the webdav_mgr.cgi script allows remote authenticated attackers to execute arbitrary code via the f_file parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices allows authenticated attackers to achieve remote code execution, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-5212

Affected Software: D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04)

Affected Versions: Firmware versions up to 20260205

Vulnerability: The vulnerability exists within the Webdav_Upload_File function of the webdav_mgr.cgi binary, where improper handling of the f_file argument leads to a stack-based buffer overflow. This flaw requires the attacker to have low-level privileges (authenticated user) to trigger the overflow and potentially execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the affected NAS device. This could lead to a total compromise of stored data, unauthorized access to sensitive files, or permanent denial of service by crashing the device. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that demands prompt attention to prevent lateral movement or data theft within the network.

Remediation Plan

Immediate Action: Check the official D-Link support portal for firmware updates addressing this vulnerability, and apply them immediately to all affected NAS units. If no patch is currently available for your specific model, restrict management interface access to trusted network segments only.

Proactive Monitoring: Review system logs for unusual POST requests directed at /cgi-bin/webdav_mgr.cgi, particularly those containing excessively long filename parameters. Monitor NAS devices for unexpected service interruptions or frequent crashes.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect and block malicious multipart/form-data payloads targeting the webdav_mgr.cgi endpoint. Restrict access to the web management interface to authorized administrative IP addresses via firewall rules.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the research write-up referenced by the CVE record.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the filename parameter, which allows for direct memory corruption.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to your storage infrastructure. Administrators should prioritize identifying all vulnerable D-Link devices within their environment and apply vendor-supplied firmware updates as soon as they are released. Until updates are applied, minimize the attack surface by isolating vulnerable devices from public-facing networks.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS and DNR Network Attached Storage (NAS) devices
AFFECTED_VERSIONS: Up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354347","name":"VDB-354347 | D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354347/cti","name":"VDB-354347 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780434","name":"Submit #780434 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_165/165.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of the app_mgr.cgi binary allows remote attackers to cause a crash or potentially execute arbitrary code via the f_dir parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices, identified as CVE-2026-5211, exposes affected systems to remote code execution and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-5211

Affected Software: D-Link DNS and DNR series NAS devices (including DNS-120, DNS-320, DNS-320L, DNS-320LW, DNS-315L, and DNR-202L)

Affected Versions: All firmware versions up to 20260205

Vulnerability: This is a stack-based buffer overflow vulnerability occurring in the /cgi-bin/app_mgr.cgi endpoint. The function UPnP_AV_Server_Path_Del fails to perform adequate bounds checking on the f_dir parameter, allowing a low-privileged authenticated attacker to overwrite the return address and potentially achieve remote code execution.

Business Impact

The vulnerability poses a severe risk to data integrity and system availability. Successful exploitation allows an attacker to crash the storage device, leading to service downtime, or execute arbitrary code to gain unauthorized control over the NAS. With a CVSS score of 8.8, this flaw is considered high-risk, as it directly impacts the confidentiality, integrity, and availability of stored data.

Remediation Plan

Immediate Action: Check the D-Link support portal for firmware updates addressing this flaw; if no patch is available for your specific model, restrict management interface access to trusted networks only.

Proactive Monitoring: Review system and access logs for unusual POST requests targeting /cgi-bin/app_mgr.cgi, specifically monitoring for abnormally long f_dir parameter strings.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter and block malicious traffic containing oversized f_dir parameters in HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the researcher's technical write-up linked in the CVE record.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it stems from a lack of input validation on a direct user-controlled parameter.

Analyst Recommendation

Given the availability of a published proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat. Administrators should prioritize identifying affected hardware within their environment and apply vendor-supplied firmware updates as soon as they become available. In the interim, isolating these storage devices from the internet is a necessary step to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/353908","name":"VDB-353908 | D-Link DIR-513 formSetEmail stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/353908/cti","name":"VDB-353908 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/778414","name":"Submit #778414 | D-Link DIR-513 1.10 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_30/README.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.195Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-513 formSetEmail function allows remote attackers to trigger memory corruption and potential code execution via a crafted HTTP POST request.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-513 routers, which are no longer supported, allows remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5024

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The vulnerability exists within the formSetEmail function located at the /goform/formSetEmail endpoint. By manipulating the curTime argument, an attacker with low privileges can trigger a stack-based buffer overflow due to a lack of length validation when processing user-provided input.

Business Impact

Successful exploitation of this vulnerability permits remote code execution, granting an attacker full control over the affected routing device. Given the device's role in network traffic management, this could lead to total compromise of internal network traffic, unauthorized access to connected resources, and severe reputational damage. The CVSS score of 8.8 reflects the high severity of this flaw, which is exacerbated by the fact that the product is end-of-life and will not receive vendor patches.

Remediation Plan

Immediate Action: Because the vendor no longer supports this device and no patch is available, the most effective remediation is to decommission and replace the affected D-Link DIR-513 hardware with a currently supported alternative.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetEmail endpoint, which may indicate attempted exploitation.

Compensating Controls: If immediate replacement is not feasible, isolate the device from the public internet using a firewall or VLAN and restrict access to the administrative interface to trusted internal management segments.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the vulnerable function.

Analyst Recommendation

The risk posed by CVE-2026-5024 is substantial, particularly because D-Link has ceased support for the DIR-513, meaning no official firmware update will be released to address the overflow. Organizations currently utilizing this equipment must prioritize its immediate removal from the network. Continued use of this device constitutes a significant security liability that cannot be fully mitigated by standard defensive configurations.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352382","name":"VDB-352382 | D-Link DIR-513 boa formEasySetTimezone memory corruption","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352382","name":"VDB-352382 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.774936","name":"Submit #774936 | D-Link DIR-513 1.10 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_24/README.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:42.587Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-513 boa web server component allows remote authenticated attackers to execute arbitrary code via the curTime parameter in formEasySetTimezone.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DIR-513 router, which is now end-of-life, poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-4555

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The vulnerability exists within the formEasySetTimezone function of the boa web component, which fails to perform bounds checking on the curTime parameter. By sending a specially crafted HTTP POST request to the /goform/formEasySetTimezone endpoint, an authenticated attacker can trigger a stack-based buffer overflow, leading to potential remote code execution or a denial of service state.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the device, potentially gaining full control over the router. Given the device serves as a network gateway, this compromise could facilitate lateral movement into the internal network, interception of traffic, or permanent denial of service. With a CVSS score of 8.8, this flaw represents a high-severity risk to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: As this product is no longer supported by the vendor and no patch is available, the primary remediation is to decommission the device immediately and replace it with a currently supported model.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formEasySetTimezone endpoint and audit system logs for signs of repeated service crashes or unexpected reboots.

Compensating Controls: If the device cannot be immediately replaced, place it behind a strict firewall that limits administrative access to trusted internal IP addresses only, and employ a Web Application Firewall to filter out malformed or excessively long input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher (GitHub: Litengzheng/vul_db).

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected function.

Analyst Recommendation

The D-Link DIR-513 is an end-of-life product and will not receive security updates to address this flaw. Organizations currently utilizing this device are at significant risk of compromise. It is strongly recommended to retire these units from production environments as soon as possible to eliminate the exposure, as no software-based mitigation can effectively resolve the underlying architectural weakness.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-820LW
AFFECTED_VERSIONS: 2.03
CONFIDENCE: high
MISSING: none
CREDITS: junqi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352055","name":"VDB-352055 | D-Link DIR-820LW SSDP ssdpcgi_main os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352055","name":"VDB-352055 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773883","name":"Submit #773883 | D-Link DIR-820LW B2.03 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/yunleeeee/cve/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/25790888/OS.Command.Injection.in.D-Link.DIR-820LW.B2.03.via.the.HTTP_ST.environment.variable.in.ssdpcgi_main.function.zip","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the D-Link DIR-820LW 2.03 firmware due to improper input validation in the ssdpcgi_main function of the SSDP component.

Executive Summary:
An unauthenticated remote OS command injection vulnerability in D-Link DIR-820LW firmware version 2.03 poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4499

Affected Software: D-Link DIR-820LW

Affected Versions: 2.03

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered via the HTTP_ST environment variable within the ssdpcgi_main function of the SSDP component. An unauthenticated remote attacker can exploit this by sending specially crafted packets to the affected device.

Business Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands with elevated privileges on the router. This can lead to complete device takeover, interception of network traffic, persistence within the local network, and potential pivot points for further attacks against internal systems. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet immediately and check the official D-Link support portal for firmware updates or security patches. If no patch is available, replace the device as it is currently vulnerable to remote exploitation.

Proactive Monitoring: Review firewall and router logs for anomalous traffic patterns, specifically looking for unusual HTTP requests or unexpected inbound SSDP traffic. Monitor for signs of unauthorized configuration changes or unexpected process execution on the device if management interfaces are accessible.

Compensating Controls: Disable UPnP and SSDP services on the router if they are not strictly required for network functionality to reduce the attack surface. Utilize a perimeter firewall to block inbound access to the router management and discovery ports from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a proof of concept and technical details are available via the research documentation referenced in the CVE record.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the nature of the SSDP service.

Analyst Recommendation

The presence of a public proof of concept combined with the ease of remote exploitation makes this a high priority for remediation. Administrators should prioritize the decommissioning or patching of these legacy devices, as they are likely to remain targets for automated exploitation attempts. If patching is not feasible, the device must be isolated from the public internet to prevent unauthorized remote command execution.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: AttackingLin (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352009","name":"VDB-352009 | D-Link DIR-513 Web Service formEasySetPassword stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352009","name":"VDB-352009 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773537","name":"Submit #773537 | D-Link DIR-513 1.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.773566","name":"Submit #773566 | D-Link DIR-513 1.10 Buffer Overflow (Duplicate)","tags":["third-party-advisory"]},{"url":"https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/formEasySetPassword.md","name":null,"tags":["related"]},{"url":"https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/poc.py","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-513 web service allows remote authenticated attackers to trigger memory corruption via the curTime parameter.

Executive Summary:
A remote stack-based buffer overflow vulnerability in D-Link DIR-513 firmware version 1.10 poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4486

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The flaw exists in the formEasySetPassword function within the /goform/formEasySetPassword endpoint. An authenticated attacker can send a crafted HTTP POST request containing a malicious curTime argument to trigger a stack-based buffer overflow, resulting in memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a complete compromise of the affected router, potentially allowing an attacker to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized network access, interception of traffic, or the redirection of internal communications. As the device is no longer supported by the vendor, the lack of official security updates significantly increases the long-term risk to organizational infrastructure.

Remediation Plan

Immediate Action: Because the product is end-of-life and no official patch is available, the most effective remediation is to retire the device and replace it with a supported model. If immediate replacement is impossible, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formEasySetPassword endpoint. Review system logs for signs of process crashes or unexpected service restarts that may indicate attempted buffer overflow exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to inspect and block HTTP requests containing overly long strings in the curTime parameter.

Exploitation Status

Public Exploit Available: Yes, a functional Python proof-of-concept script is available via the GitHub repository referenced in the vulnerability research write-up.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the stack-based overflow in the web service component.

Analyst Recommendation

The presence of a functional proof-of-concept, combined with the fact that D-Link no longer provides security support for this device, necessitates immediate action. Organizations currently utilizing the D-Link DIR-513 should prioritize the decommissioning of these units to prevent potential remote code execution and network compromise. If the hardware cannot be retired immediately, strict network segmentation and perimeter filtering are required to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-456U
AFFECTED_VERSIONS: Hardware Revision A1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-456U Rev A1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-456U allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42376

Affected Software: D-Link DIR-456U

Affected Versions: Hardware Revision A1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-456U device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-600L
AFFECTED_VERSIONS: Hardware Revision A1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-600L Rev A1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-600L allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42375

Affected Software: D-Link DIR-600L

Affected Versions: Hardware Revision A1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-600L device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-600L
AFFECTED_VERSIONS: Hardware Revision B1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-600L Rev B1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-600L allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42374

Affected Software: D-Link DIR-600L

Affected Versions: Hardware Revision B1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-600L device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: Hardware Revision B2 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-605L revision B2 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full administrative root access.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-605L router exposes the device to complete administrative compromise by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-42373

Affected Software: D-Link DIR-605L

Affected Versions: Hardware Revision B2 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor with static credentials, enabling an unauthenticated attacker on the local network to obtain a root shell via the telnet daemon.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker full administrative control over the network gateway, potentially leading to total network interception, internal reconnaissance, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Given the device has reached End-of-Life (EOL) and will not receive a patch, the only effective remediation is to retire and replace the hardware immediately.

Proactive Monitoring: Monitor network traffic for unexpected telnet (port 23) connections and audit logs for successful logins originating from unauthorized internal IP addresses.

Compensating Controls: If immediate replacement is impossible, disable the telnet service via the device management interface or use an access control list (ACL) to strictly limit network access to the router’s management ports.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the lack of vendor support, the potential for exploitation is high.

Analyst Recommendation

The presence of a hardcoded backdoor in network infrastructure represents an unacceptable security risk. We strongly recommend decommissioning all affected D-Link DIR-605L units immediately to eliminate this vector of compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L Hardware Revision A1
AFFECTED_VERSIONS: D-Link DIR-605L Firmware: A1
CONFIDENCE: high
MISSING: patch
CREDITS: Arjun Basnet From Securin Labs (finder)
SOURCES_JSON: [{"url":"https://www.securin.io/zero-day/cve-2026-42372-hardcoded-telnet-backdoor-in-d-link-dir-605l-a1-end-of-life-","name":"D-Link DIR-605L Support Page","tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:45:46.263Z
---END_METADATA---

Description Summary:
D-Link DIR-605L Revision A1 contains a hardcoded telnet backdoor allowing full administrative root access to network attackers.

Executive Summary:
D-Link DIR-605L Hardware Revision A1 contains a hardcoded telnet backdoor, exposing the affected device to complete administrative compromise by network attackers.

Vulnerability Details

CVE-ID: CVE-2026-42372

Affected Software: D-Link DIR-605L Hardware Revision A1

Affected Versions: D-Link DIR-605L Firmware: A1

Vulnerability: This vulnerability is caused by the use of hardcoded credentials (CWE-798) in the device telnet daemon startup script, which accepts static login values and can be exploited by an unauthenticated attacker on the local network.

Business Impact

A successful exploit grants an attacker a root shell with full administrative control over the affected hardware, leading to potential total network compromise and data interception. The CVSS score of 8.8 reflects the severity of this access level, though the risk is constrained by requiring local network adjacency.

Remediation Plan

Immediate Action: Disconnect the affected device from the network immediately, as the hardware has reached End-of-Life status and will not receive vendor patches.

Proactive Monitoring: Monitor network perimeter logs and internal segment traffic for unauthorized telnet connections and brute force authentication attempts.

Compensating Controls: Implement network segmentation and firewall rules to strictly isolate the vulnerable router from untrusted network segments.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, cited in the researcher advisory at Securin.

Analyst Notes: As of May 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of hardcoded credentials provides an immediate access vector for any actor with local network access.

Analyst Recommendation

Given that the affected product is End-of-Life and will not receive security patches from the vendor, immediate hardware replacement is the only effective remediation. Organizations must retire the vulnerable device and transition to a supported hardware model to eliminate the persistent risk of unauthorized administrative access.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS/DNR Series NAS
AFFECTED_VERSIONS: All firmware versions up to 20260205
CONFIDENCE: high
MISSING: none
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351125","name":"VDB-351125 | D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351125","name":"VDB-351125 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.770445","name":"Submit #770445 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_164/164.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in various D-Link NAS devices, allowing a remote authenticated attacker to crash the server or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices allows remote authenticated attackers to compromise system stability and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-4214

Affected Software: D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04.

Affected Versions: Firmware versions up to 20260205.

Vulnerability: This vulnerability is a stack-based buffer overflow located in the UPnP_AV_Server_Path_Setting function within the /cgi-bin/app_mgr.cgi binary. By sending a crafted, overly long f_dir parameter, an attacker with low-level authenticated access can override the function return address, leading to a crash or arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service for the affected network-attached storage device, resulting in data unavailability and operational disruption. Furthermore, because the flaw allows for potential arbitrary code execution, an attacker could gain unauthorized control over the device, leading to a compromise of sensitive stored data or lateral movement within the network. The CVSS score of 8.8 reflects the high severity of this remote code execution risk.

Remediation Plan

Immediate Action: Update the affected D-Link NAS devices to the latest firmware version released after 20260205, as this includes the necessary security patches to address the overflow.

Proactive Monitoring: Monitor access logs for the /cgi-bin/app_mgr.cgi endpoint, specifically looking for POST requests containing abnormally large f_dir parameter strings or unexpected administrative activity.

Compensating Controls: Implement strict network access control to ensure only trusted administrative accounts can reach the management interface, and utilize a Web Application Firewall to drop requests containing suspicious or malformed input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical research write-up by Jiaqian Peng.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the f_dir parameter.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat to organizational data integrity and availability. Administrators must prioritize the application of vendor-supplied firmware updates immediately to remediate the buffer overflow. If immediate patching is not feasible, restrict access to the device management interface to trusted internal segments only to reduce the attack surface.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS and DNR series NAS devices
AFFECTED_VERSIONS: All versions up to and including 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351124","name":"VDB-351124 | D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351124","name":"VDB-351124 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.770443","name":"Submit #770443 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.770444","name":"Submit #770444 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_162/162.md","name":null,"tags":["related"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_163/163.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in multiple D-Link NAS devices due to improper input validation in the cgi_myfavorite_verify function, allowing remote attackers to trigger a crash or code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in various D-Link network storage devices allows remote attackers to compromise system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-4213

Affected Software: D-Link DNS and DNR series NAS devices (including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, and others).

Affected Versions: All firmware versions up to 20260205.

Vulnerability: The vulnerability is located within the /cgi-bin/gui_mgr.cgi endpoint, specifically in the cgi_myfavorite_verify function. An authenticated attacker can send a maliciously crafted HTTP POST request containing an overly long f_lst parameter, which triggers a stack-based buffer overflow and permits arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code or cause a persistent denial of service on affected storage devices. Given the CVSS score of 8.8, this represents a high risk to business operations, as these devices often house sensitive data backups. Compromise of these units could lead to unauthorized access to stored corporate information or total loss of data availability.

Remediation Plan

Immediate Action: Monitor official D-Link support channels for firmware updates that address this buffer overflow. If no patch is currently available, restrict access to the management interface of the affected devices to trusted internal IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/gui_mgr.cgi, particularly those containing unusually long strings within the f_lst parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block HTTP requests to the /cgi-bin/gui_mgr.cgi endpoint that contain excessive data lengths in the f_lst field.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up referenced in the CVE record.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no complex bypasses beyond authenticated access to the management interface.

Analyst Recommendation

Due to the availability of proof-of-concept code and the critical impact of remote code execution, this vulnerability poses a significant risk to the integrity of backup infrastructure. Administrators should prioritize isolating these devices from external networks immediately and apply the vendor-provided firmware update as soon as it becomes available.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS Devices (DNS/DNR series)
AFFECTED_VERSIONS: Up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351123","name":"VDB-351123 | D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351123","name":"VDB-351123 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.770442","name":"Submit #770442 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_161/161.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Downloads_Schedule_Info function of the download_mgr.cgi script allows remote authenticated attackers to execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in various D-Link NAS devices allows authenticated attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-4212

Affected Software: D-Link NAS devices (including DNS-120, DNR-202L, DNS-320, and others)

Affected Versions: Up to 20260205

Vulnerability: The vulnerability resides in the Downloads_Schedule_Info function within the download_mgr.cgi file. An attacker can supply a malicious, overly long f_idx parameter to cause a stack-based buffer overflow, which can lead to remote code execution or a denial of service.

Business Impact

Successful exploitation of this vulnerability could lead to a total compromise of the affected D-Link NAS device, resulting in unauthorized access to sensitive stored data or complete system failure. Given the CVSS score of 8.8, this poses a high risk to business continuity and data confidentiality. The ability to execute arbitrary code remotely allows an attacker to establish persistence within the network or exfiltrate private files.

Remediation Plan

Immediate Action: Monitor the D-Link support portal for firmware updates addressing this flaw and apply them to all affected NAS units as soon as they become available.

Proactive Monitoring: Review web access logs for suspicious POST requests directed at /cgi-bin/download_mgr.cgi containing unusually long f_idx parameters.

Compensating Controls: Restrict access to the NAS management interface to trusted internal IP addresses using firewall rules to prevent unauthorized remote access to the vulnerable CGI script.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the researcher's technical write-up.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it involves a straightforward stack overflow triggered via a standard HTTP POST request.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing the affected D-Link NAS devices must prioritize the implementation of network-level access controls to isolate these devices from external threats. Administrators should monitor vendor channels for the release of a corrective patch and ensure it is deployed immediately upon availability to prevent potential exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS devices (DNS and DNR series)
AFFECTED_VERSIONS: Up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351122","name":"VDB-351122 | D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351122","name":"VDB-351122 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.770441","name":"Submit #770441 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_160/160.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in various D-Link NAS devices within the Local_Backup_Info function of /cgi-bin/local_backup_mgr.cgi, allowing remote code execution via the f_idx parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices allows remote attackers to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-4211

Affected Software: D-Link NAS Devices (including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, and others)

Affected Versions: All firmware versions up to 20260205

Vulnerability: This vulnerability is a stack-based buffer overflow occurring in the Local_Backup_Info function within the local_backup_mgr.cgi binary. By sending a specially crafted, overly long f_idx parameter to the affected endpoint, an authenticated attacker can overwrite the function return address to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational data integrity and availability. Because the flaw allows for arbitrary code execution, an attacker could gain full control over the NAS device, leading to unauthorized access to stored files, data exfiltration, or complete system compromise. Given the CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent potential service disruption or loss of sensitive information.

Remediation Plan

Immediate Action: Check the official D-Link support portal for firmware updates addressing this buffer overflow and apply them immediately to all affected devices.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /cgi-bin/local_backup_mgr.cgi endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block excessively long f_idx parameter values in POST requests to the identified CGI binary.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists and is attributed to the researcher's write-up referenced in the CVE record.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of technical details and exploit code increases the likelihood of opportunistic attacks against unpatched devices.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for remote code execution on storage infrastructure. Organizations should prioritize patching all D-Link NAS devices listed in the affected scope. If patching is not immediately feasible, restrict management interface access to trusted internal networks and utilize WAF filtering to mitigate the risk of exploitation until permanent updates are applied.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS (Network Attached Storage)
AFFECTED_VERSIONS: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 (up to 20260205)
CONFIDENCE: high
MISSING: patch
CREDITS: pjq123 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351106","name":"VDB-351106 | D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351106","name":"VDB-351106 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769853","name":"Submit #769853 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/340L/343/345/726-4/1100-4/1200-05/155","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_96/96.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.310Z
---END_METADATA---

Description Summary:
A vulnerability in the cgi_set_wto function of D-Link NAS devices allows unauthenticated remote attackers to bypass access controls and perform unauthorized administrative actions.

Executive Summary:
Multiple D-Link network storage devices are susceptible to an unauthenticated access control bypass that permits attackers to modify administrative configurations and execute unauthorized system commands.

Vulnerability Details

CVE-ID: CVE-2026-4194

Affected Software: D-Link NAS (various models)

Affected Versions: All versions up to 20260205

Vulnerability: This vulnerability resides in the cgi_set_wto function within /cgi-bin/system_mgr.cgi, where improper access controls allow an unauthenticated attacker to manipulate system settings. By sending specially crafted requests, an attacker can modify administrative accounts or trigger unauthorized device operations.

Business Impact

The ability for an unauthenticated attacker to gain persistent, privileged access to network-attached storage poses a severe risk to data confidentiality and integrity. Given the CVSS score of 7.3, this flaw enables unauthorized management of sensitive files and potential device takeover, leading to significant operational disruption and the potential for long-term data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch is not currently identified, users should isolate affected D-Link NAS devices from the public internet immediately and restrict management interface access to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unexpected POST requests directed at /cgi-bin/system_mgr.cgi, particularly those invoking the cgi_set_wto or cgi_shutdown commands from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter incoming HTTP requests to the device web interface, specifically blocking unauthorized calls to the identified vulnerable CGI scripts.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept has been published in the researcher's technical write-up on GitHub.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no authentication to trigger the flawed CGI interface.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations must prioritize the mitigation of these devices. Administrators should ensure these units are not exposed to the internet and remain vigilant for vendor-released firmware updates that address the identified access control failures.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-823G
AFFECTED_VERSIONS: 1.0.2B05
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351105","name":"VDB-351105 | D-Link DIR-823G goahead UpdateClientInfo access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351105","name":"VDB-351105 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769835","name":"Submit #769835 | D-Link 1.0.2B05 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.769836","name":"Submit #769836 | D-Link DIR823G 1.0.2B05 Improper Access Controls (Duplicate)","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.769837","name":"Submit #769837 | D-Link DIR823G 1.0.2B05 Improper Access Controls (Duplicate)","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.769838","name":"Submit #769838 | D-Link DIR823G 1.0.2B05 Improper Access Controls (Duplicate)","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.769839","name":"Submit #769839 | D-Link DIR823G 1.0.2B05 Stack-based Buffer Overflow (Duplicate)","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.769841","name":"Submit #769841 | D-Link DIR823G 1.0.2B05 Improper Access Controls (Duplicate)","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.314Z
---END_METADATA---

Description Summary:
A vulnerability in the goahead component of D-Link DIR-823G 1.0.2B05 allows remote, unauthenticated attackers to bypass access controls via multiple functions.

Executive Summary:
A critical access control vulnerability in the D-Link DIR-823G router allows unauthenticated remote attackers to manipulate device settings and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-4193

Affected Software: D-Link DIR-823G

Affected Versions: 1.0.2B05

Vulnerability: The vulnerability exists within the goahead web server component, where improper access controls in numerous administrative functions allow unauthenticated remote attackers to modify device configurations. This flaw stems from improper privilege assignment, enabling unauthorized access to sensitive router management settings.

Business Impact

The ability for an unauthenticated attacker to remotely modify router settings presents a significant risk to network security, potentially leading to unauthorized traffic interception, configuration tampering, or complete loss of network control. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized access to internal network infrastructure.

Remediation Plan

Immediate Action: As the affected device is no longer supported by the vendor, the most effective remediation is to retire the hardware and replace it with a supported model.

Proactive Monitoring: Monitor network traffic for unusual administrative requests or unauthorized changes to router configuration parameters.

Compensating Controls: If immediate replacement is not feasible, isolate the device from the public internet using a firewall and disable remote management interfaces to prevent external access.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the VulDB references.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The breadth of affected functions across the goahead component makes this device highly susceptible to configuration manipulation.

Analyst Recommendation

Given that D-Link no longer provides security updates for the DIR-823G, this device is effectively in an end-of-life state and poses a permanent security risk to any network where it remains deployed. Organizations must prioritize the decommissioning of this hardware to eliminate the risk of remote configuration hijacking.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-619L
AFFECTED_VERSIONS: 2.06B01
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351094","name":"VDB-351094 | D-Link DIR-619L boa formSchedule stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351094","name":"VDB-351094 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769833","name":"Submit #769833 | D-Link DIR619L 2.06B01 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_89/89.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the boa component of D-Link DIR-619L version 2.06B01 allows remote attackers to execute arbitrary code via the curTime argument in the /goform/formSchedule endpoint.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-619L routers allows remote attackers to trigger memory corruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-4188

Affected Software: D-Link DIR-619L

Affected Versions: 2.06B01

Vulnerability: The vulnerability exists in the formSchedule function within the boa component, where the curTime parameter is copied to a local stack variable without sufficient bounds checking. This flaw allows a low-privileged authenticated attacker to overwrite the function return address and achieve code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and availability. Because the affected device is a router, an attacker gaining code execution could intercept traffic, redirect internal network requests, or permanently disable the device, leading to significant operational downtime. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized control of network infrastructure.

Remediation Plan

Immediate Action: As the affected product is no longer supported by the vendor, there is no official patch available. Owners must immediately decommission the affected hardware and replace it with a supported device.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests targeting the /goform/formSchedule endpoint, particularly those containing abnormally long strings in the curTime parameter.

Compensating Controls: If the device cannot be immediately replaced, implement network-level access control lists (ACLs) to restrict access to the management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the vulnerable parameter.

Analyst Recommendation

Given that the D-Link DIR-619L is at end-of-life status and no security updates will be provided, the only effective remediation is the immediate retirement of the device from the production environment. Continued use of this hardware exposes the network to trivial remote compromise. Organizations should prioritize the migration to modern, vendor-supported networking equipment to eliminate this risk.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The D-Link DIR-816 is susceptible to a remote stack-based buffer overflow via the pskValue argument in the form2Wl5BasicSetup.cgi script.

Executive Summary:
A critical stack-based buffer overflow in the D-Link DIR-816 allows remote, unauthenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-4184

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: The vulnerability resides in the goahead component within the /goform/form2Wl5BasicSetup.cgi file. By manipulating the pskValue argument, an unauthenticated remote attacker can trigger a stack-based buffer overflow.

Business Impact

A CVSS score of 9.8 reflects the potential for full system compromise, including the execution of arbitrary code with high privileges. Since the product is no longer supported, this vulnerability remains a permanent risk to any network utilizing these legacy devices.

Remediation Plan

Immediate Action: Because the product is end-of-life and unsupported, the only effective remediation is to replace the device with a currently supported model.

Proactive Monitoring: Monitor traffic for unexpected crash patterns in the web interface and inspect logs for unusually long or malformed input strings in web requests.

Compensating Controls: Place the device behind a robust firewall and disable remote management interfaces to minimize exposure to external attack vectors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 16, 2026, public exploit code is available for this vulnerability. Given that the device is no longer supported by D-Link, there is no expectation of an official patch.

Analyst Recommendation

The reliance on an end-of-life product with a critical, publicly exploitable vulnerability is unacceptable for secure operations. Immediate decommissioning and replacement of the D-Link DIR-816 is strongly advised to eliminate this exposure.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A remote stack-based buffer overflow exists in the D-Link DIR-816 via the pskValue argument in the form2WlanBasicSetup.cgi script.

Executive Summary:
A critical stack-based buffer overflow in the D-Link DIR-816 allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-4183

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability affects the goahead component in the /goform/form2WlanBasicSetup.cgi file. An unauthenticated attacker can exploit this via the pskValue argument to overflow the stack, potentially hijacking the execution flow.

Business Impact

The severity of this flaw (CVSS 9.8) indicates a high likelihood of successful system takeover. As an unsupported legacy device, the risk of permanent, unpatchable exposure makes this a critical threat to the confidentiality, integrity, and availability of the network.

Remediation Plan

Immediate Action: Retire the affected hardware immediately, as the manufacturer no longer provides security updates for the D-Link DIR-816.

Proactive Monitoring: Observe network logs for suspicious HTTP POST requests directed at the /goform/ directory and monitor for device instability or unexpected reboots.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block requests containing abnormally long strings in the pskValue parameter if immediate replacement is not feasible.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 16, 2026, active public exploit information is available. The lack of vendor support for this device necessitates an urgent migration to modern, supported hardware.

Analyst Recommendation

The combination of a 9.8 CVSS score and the lack of vendor support creates an extreme risk profile. Security teams must prioritize the removal of these devices from all production environments immediately.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-816 goahead component allows remote attackers to execute arbitrary code via manipulated arguments in form2Wl5RepeaterStep2.cgi.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-816 routers enables remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-4182

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the goahead component's handling of the form2Wl5RepeaterStep2.cgi file. An unauthenticated remote attacker can trigger this condition by supplying malicious input to the key1, key2, key3, key4, or pskValue arguments.

Business Impact

Successful exploitation of this vulnerability allows for remote code execution, which could result in complete loss of device control, unauthorized network access, and potential lateral movement into internal systems. Given the CVSS score of 9.8, this represents a critical risk that could lead to significant operational disruption and data breach.

Remediation Plan

Immediate Action: As the affected product is end-of-life and no patch is available, the primary remediation is to retire the device and replace it with a supported alternative.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the /goform/form2Wl5RepeaterStep2.cgi endpoint.

Compensating Controls: Implement strict firewall rules to prevent external access to the administrative interface of the router.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, public exploit code is available for this vulnerability. Because the vendor no longer supports this hardware, users are at permanent risk of exploitation.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of vendor-supplied patches, we strongly recommend the immediate decommissioning of affected D-Link DIR-816 units. If replacement is not immediately feasible, ensure the device is isolated from the public internet using robust perimeter security controls.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-816 goahead component allows remote attackers to execute arbitrary code via manipulated arguments in form2RepeaterStep2.cgi.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-816 routers enables remote code execution, creating a high risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-4181

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability involves a stack-based buffer overflow in the goahead component, specifically within the form2RepeaterStep2.cgi file. An unauthenticated remote attacker can exploit this by sending specially crafted input to the key1, key2, key3, key4, or pskValue parameters.

Business Impact

The severity of this flaw, rated at 9.8, indicates that unauthorized parties could potentially gain full control over the router. This access facilitates the interception of network traffic, redirection of user sessions, and broad reconnaissance of the internal network, posing a severe threat to organizational security.

Remediation Plan

Immediate Action: Since the product has reached end-of-life status, the recommended course of action is to replace the hardware immediately.

Proactive Monitoring: Review system and firewall logs for suspicious web requests targeting the /goform/form2RepeaterStep2.cgi file.

Compensating Controls: Restrict access to the router's web interface to trusted internal IP addresses only via a secure gateway.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, public exploit code is available for this vulnerability. As the vendor has ceased support for this product, no security updates will be provided.

Analyst Recommendation

The presence of a publicly available exploit necessitates immediate action to mitigate the risk. Organizations should prioritize replacing these unsupported devices as they cannot be secured against this critical vulnerability.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351084","name":"VDB-351084 | D-Link DIR-816 goahead redirect.asp access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351084","name":"VDB-351084 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769828","name":"Submit #769828 | D-Link DIR816 1.10CNB05 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_84/84.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.314Z
---END_METADATA---

Description Summary:
An unauthenticated access control vulnerability in the D-Link DIR-816 goahead component allows attackers to retrieve token IDs via redirect.asp, enabling full unauthorized device configuration.

Executive Summary:
A critical, unauthenticated access control vulnerability in the D-Link DIR-816 router allows remote attackers to bypass authentication and modify device configurations.

Vulnerability Details

CVE-ID: CVE-2026-4180

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability involves improper access controls within the goahead component, specifically the redirect.asp file. An unauthenticated remote attacker can access this file to obtain valid authentication tokens, which allows them to bypass security controls and perform unauthorized administrative actions, such as resetting Wi-Fi credentials.

Business Impact

Successful exploitation of this vulnerability results in a total compromise of the affected router's management and wireless security. Because the device is end-of-life and unsupported by the vendor, there is no path for official security patches, leaving the device permanently exposed to unauthorized configuration changes and potential lateral movement within the network. With a CVSS score of 7.3, this represents a high-risk scenario for any environment still utilizing this hardware.

Remediation Plan

Immediate Action: As this product is no longer supported by D-Link and no patch is available, the immediate recommendation is to decommission and replace the affected device with a currently supported router.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the router's management interface, particularly requests targeting the redirect.asp endpoint.

Compensating Controls: If immediate replacement is not feasible, isolate the router from the public internet using a robust firewall and restrict management access to a dedicated, secure local management VLAN.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up provided by Jiaqian Peng.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it allows unauthenticated attackers to trivially harvest authentication tokens and seize control of the device.

Analyst Recommendation

The D-Link DIR-816 is confirmed to be end-of-life and contains a critical, unauthenticated vulnerability for which no vendor fix will be provided. Organizations must treat these devices as inherently compromised if they remain exposed to the network. We strongly recommend immediate retirement and replacement of all units to mitigate the risk of unauthorized network access and potential data exfiltration.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.350413","name":"VDB-350413 | D-Link DIR-513 formEasySetupWizard3 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.350413","name":"VDB-350413 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769586","name":"Submit #769586 | D-Link DIR-513 1.10 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_21/README.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.346Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-513 web interface allows remote attackers to trigger memory corruption and potentially achieve remote code execution via a crafted HTTP POST request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DIR-513 firmware version 1.10 exposes the device to remote code execution or denial of service attacks.

Vulnerability Details

CVE-ID: CVE-2026-3978

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The vulnerability exists within the /goform/formEasySetupWizard3 endpoint, which fails to perform bounds checking on the wan_connected parameter. An attacker with low privileges can trigger a stack-based buffer overflow by supplying an overly long string to this parameter, leading to memory corruption.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary code on the affected router or crash the system, resulting in a complete loss of service. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device compromise, allowing attackers to intercept network traffic or pivot into the internal network.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the device management interface by placing it behind a firewall or disabling remote management features.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formEasySetupWizard3 endpoint and review device logs for signs of repetitive crashes or unexpected reboots.

Compensating Controls: If the device must remain accessible, implement a Web Application Firewall (WAF) rule to block or truncate HTTP requests containing excessively long values in the wan_connected parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's technical write-up on GitHub.

Analyst Notes: As of March 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation in the affected function.

Analyst Recommendation

This vulnerability poses a significant risk to the integrity and availability of the affected D-Link hardware. Given the availability of a public proof-of-concept and the potential for remote code execution, administrators must prioritize isolating affected devices from the internet immediately and monitor for vendor updates to address this memory corruption flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-868L Router
AFFECTED_VERSIONS: 110b03
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the D-Link DIR-868L SSDP service allows unauthenticated remote attackers to execute arbitrary commands via the ST argument.

Executive Summary:
The D-Link DIR-868L router is subject to a critical remote command injection vulnerability in its SSDP service, which is currently being exploited by attackers using publicly available code.

Vulnerability Details

CVE-ID: CVE-2026-3485

Affected Software: D-Link DIR-868L Router

Affected Versions: 110b03

Vulnerability: An OS command injection flaw exists in the sub_1BF84 function of the SSDP service component. An unauthenticated remote attacker can manipulate the ST argument to execute arbitrary system commands with elevated privileges.

Business Impact

The impact of this vulnerability is catastrophic, as evidenced by its CVSS score of 9.8. A successful exploit allows an attacker to gain full control over the router, potentially leading to network interception, data theft, and lateral movement into the internal network. Because this product is end-of-life (EOL), no further security updates will be provided, leaving the hardware permanently vulnerable.

Remediation Plan

Immediate Action: Discontinue the use of the D-Link DIR-868L immediately and replace it with a currently supported model that receives regular security updates.

Proactive Monitoring: Review network traffic for unauthorized outbound connections or unusual UPnP/SSDP activity originating from the device.

Compensating Controls: If immediate replacement is impossible, disable the SSDP service and place the device behind a strict firewall that blocks external access to the management interfaces.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Mar 3, 2026, a public exploit for this vulnerability has been published and is being utilized by attackers. This significantly increases the likelihood of automated attacks targeting exposed D-Link hardware.

Analyst Recommendation

Due to the critical severity and the lack of vendor support for this EOL product, the only secure recommendation is to decommission the affected hardware. Organizations must move to modern, supported networking equipment to ensure the security of their perimeter and internal communications.

---METADATA---
VENDOR: mrmn2
PRODUCT: PdfDing
AFFECTED_VERSIONS: < 1.7.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3","name":"https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/mrmn2/PdfDing/pull/294","name":"https://github.com/mrmn2/PdfDing/pull/294","tags":["x_refsource_MISC"]},{"url":"https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a","name":"https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a","tags":["x_refsource_MISC"]},{"url":"https://github.com/mrmn2/PdfDing/releases/tag/v1.7.0","name":"https://github.com/mrmn2/PdfDing/releases/tag/v1.7.0","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.303Z
---END_METADATA---

Description Summary:
An access control vulnerability in PdfDing allows unauthenticated users to bypass password verification and retrieve protected PDF documents.

Executive Summary:
An unauthenticated access control flaw in PdfDing versions prior to 1.7.0 allows unauthorized retrieval of password-protected documents, posing a high risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34376

Affected Software: mrmn2 PdfDing

Affected Versions: < 1.7.0

Vulnerability: The application fails to properly enforce access controls, allowing unauthenticated attackers to retrieve password-protected PDFs by directly invoking the file-serving endpoint without completing the required authentication flow.

Business Impact

The vulnerability enables unauthorized parties to access sensitive, password-protected documents without credentials. With a CVSS score of 7.5, this high-severity flaw directly compromises the confidentiality of shared data, potentially leading to unauthorized disclosure of confidential information and regulatory compliance failures.

Remediation Plan

Immediate Action: Update the PdfDing installation to version 1.7.0 or later to implement the necessary access control checks.

Proactive Monitoring: Review web server and application access logs for repeated or suspicious requests to document-serving endpoints that bypass typical user authentication patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to document-serving endpoints, ensuring that requests are validated before reaching the backend application.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature and the lack of required privileges for an attacker.

Analyst Recommendation

Given the ease of exploitation for this access control bypass, administrators should prioritize updating to version 1.7.0 immediately. Failure to patch leaves sensitive, password-protected documents exposed to any user with network access to the application.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347329","name":"VDB-347329 | D-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347329","name":"VDB-347329 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754517","name":"Submit #754517 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/29","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.782Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to trigger a denial of service or potentially execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability exists in the D-Link DWR-M960 router, posing a significant risk of device compromise or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-2962

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: The vulnerability exists in the function sub_460F30 within the /boafrm/formDateReboot endpoint. By providing an oversized input to the submit-url parameter during a save operation, an authenticated attacker can trigger a buffer overflow due to the unsafe use of the strcpy function.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the router, resulting in a denial of service for all dependent network traffic. More severely, the memory corruption can be leveraged to achieve arbitrary code execution with root-level privileges, potentially granting the attacker full control over the network gateway. With a CVSS score of 8.8, this flaw represents a high-severity threat to business continuity and internal network security.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the device management interface to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formDateReboot endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network-level access control to filter or block requests containing excessively long parameters to the vulnerable configuration endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher write-up at the provided GitHub reference.

Analyst Notes: As of February 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the use of an unsafe string copy operation that lacks bounds checking.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to affected infrastructure. Organizations using the D-Link DWR-M960 must prioritize isolating the device management interface from untrusted networks immediately. Monitor vendor communication channels closely for the release of a firmware update and apply it as soon as it becomes available to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: Hardware B1, Firmware V1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347328","name":"VDB-347328 | D-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347328","name":"VDB-347328 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754513","name":"Submit #754513 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/28","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.786Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to cause a denial of service or potentially execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows for remote device compromise and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-2961

Affected Software: D-Link DWR-M960

Affected Versions: Hardware B1, Firmware V1.01.07

Vulnerability: The vulnerability exists in the /boafrm/formVpnConfigSetup endpoint within the sub_4196C4 function. An attacker with low-level privileges can trigger a stack-based buffer overflow by providing an excessively long string to the submit-url parameter, which is processed using an unsafe strcpy operation.

Business Impact

Successful exploitation of this flaw can lead to a complete denial of service by crashing the device firmware or web server. More severely, the memory corruption may allow an attacker to hijack the execution flow, potentially leading to arbitrary code execution with root-level privileges. Given the CVSS score of 8.8, this represents a high-risk scenario for organizations relying on these devices for network connectivity.

Remediation Plan

Immediate Action: Check the D-Link support portal for the latest firmware release for Hardware B1 and apply the update immediately if a patch is available. If no patch is provided by the vendor, restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formVpnConfigSetup endpoint. Investigate any unexpected reboots or service interruptions occurring on the DWR-M960 units.

Compensating Controls: Implement a Web Application Firewall or network access control list to filter traffic to the management interface. Ensure that the device is not exposed to the public internet to prevent remote exploitation.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked research write-up on GitHub.

Analyst Notes: As of February 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the use of unsafe C library functions in a network-facing component.

Analyst Recommendation

This vulnerability presents a significant risk to network infrastructure integrity. Organizations using the D-Link DWR-M960 should prioritize identifying affected firmware versions and applying vendor-supplied security updates as soon as they become available. Until remediation is confirmed, isolating the affected hardware from external network access is the most effective way to prevent exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347327","name":"VDB-347327 | D-Link DWR-M960 formDhcpv6s sub_468D64 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347327","name":"VDB-347327 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754512","name":"Submit #754512 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/27","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.786Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to cause a denial of service or potentially execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DWR-M960 router, identified in firmware version 1.01.07, poses a significant risk of remote code execution or device compromise.

Vulnerability Details

CVE-ID: CVE-2026-2960

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: The vulnerability exists in the function sub_468D64 within the /boafrm/formDhcpv6s endpoint, where an unsafe strcpy operation fails to validate the length of the submit-url parameter. This flaw allows a remote, authenticated attacker to trigger memory corruption, leading to a crash or arbitrary code execution with root-level privileges.

Business Impact

The exploitation of this vulnerability can lead to a complete denial of service of network infrastructure or unauthorized administrative access to the router. Given the CVSS score of 8.8, this represents a high-severity risk that could expose internal network traffic to interception, facilitate lateral movement, or result in long-term device hijacking.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the web management interface of the DWR-M960 to trusted internal IP addresses only. Disable external management features immediately to prevent remote exploitation attempts.

Proactive Monitoring: Monitor system logs for repeated crashes of the web server (boa) or unusual POST requests targeting the /boafrm/formDhcpv6s endpoint. Sudden, unexplained reboots of the device should be investigated as potential evidence of exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to inspect and block HTTP POST requests containing excessively long submit-url parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's write-up on GitHub.

Analyst Notes: As of February 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the user-supplied input.

Analyst Recommendation

Given the severity of this buffer overflow and the availability of a public proof-of-concept, users must prioritize securing their D-Link DWR-M960 devices. Immediately isolate these units from the public internet and continue to monitor vendor support channels for the release of a firmware update that addresses the unsafe memory handling.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: none
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347326","name":"VDB-347326 | D-Link DWR-M960 formNewSchedule sub_44E0F8 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347326","name":"VDB-347326 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754511","name":"Submit #754511 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/26","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.786Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to execute arbitrary code or cause a denial of service via the submit-url parameter in /boafrm/formNewSchedule.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DWR-M960 routers could allow remote attackers to achieve arbitrary code execution or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-2959

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: This is a stack-based buffer overflow occurring in the sub_44E0F8 function within the /boafrm/formNewSchedule endpoint. By sending a specially crafted, oversized submit-url parameter to the device, a low-privileged authenticated attacker can corrupt memory to trigger a crash or hijack execution flow.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Because the web server typically runs with root privileges, an attacker could gain full control over the router, enabling persistent unauthorized access, traffic interception, or total network compromise. The CVSS score of 8.8 reflects the high potential for system-wide impact and the relative ease of exploitation.

Remediation Plan

Immediate Action: Check the D-Link support portal for the latest firmware release and update the device immediately to a version beyond 1.01.07. If no patch is available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unauthorized attempts to access the /boafrm/formNewSchedule endpoint. Inspect network traffic for unusually large POST requests directed at the router management interface.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block requests to the vulnerable management endpoint from untrusted sources. Ensure the device management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the referenced GitHub research write-up.

Analyst Notes: As of February 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the user-controlled input parameter.

Analyst Recommendation

Given the potential for remote code execution and the availability of a public proof-of-concept, this vulnerability should be treated as a high-priority item for remediation. Administrators must prioritize firmware updates and ensure that router management interfaces are strictly isolated from the public internet to prevent unauthorized exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: Hardware B1, Firmware V1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347325","name":"VDB-347325 | D-Link DWR-M960 formWsc sub_457C5C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347325","name":"VDB-347325 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754509","name":"Submit #754509 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/25","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.786Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to cause a denial of service or potentially achieve arbitrary code execution via the /boafrm/formWsc endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows remote attackers to crash the device or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-2958

Affected Software: D-Link DWR-M960

Affected Versions: Hardware B1, Firmware V1.01.07

Vulnerability: The vulnerability exists in the function sub_457C5C within the /boafrm/formWsc endpoint, where an unsafe strcpy operation handles the submit-url parameter without bounds checking. While the CVSS vector indicates low privileges are required, the flaw allows an authenticated attacker to trigger memory corruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network availability and integrity. By triggering a buffer overflow, an attacker can crash the web interface or the entire router, leading to significant service downtime. Furthermore, the potential for arbitrary code execution could allow an attacker to gain full control over the gateway, enabling lateral movement within the local network or interception of sensitive traffic.

Remediation Plan

Immediate Action: Contact D-Link support or monitor the official D-Link security portal for a firmware update that addresses this overflow in the /boafrm/formWsc endpoint.

Proactive Monitoring: Review web server logs for suspicious POST requests to /boafrm/formWsc containing unusually long strings in the submit-url parameter.

Compensating Controls: Restrict access to the router administrative interface to trusted management IP addresses and disable remote management features if they are not strictly necessary.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of February 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking on user-supplied input in a critical system function.

Analyst Recommendation

Given the severity of this memory corruption flaw and the availability of a public proof-of-concept, users must prioritize securing their D-Link DWR-M960 devices. If a vendor patch is not yet available, administrators should immediately isolate the device management interface from the public internet to prevent remote exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347276","name":"VDB-347276 | D-Link DWR-M960 Wireless Access Control Endpoint formWlAc sub_453140 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347276","name":"VDB-347276 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754503","name":"Submit #754503 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/24","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.790Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 Wireless Access Control endpoint allows authenticated attackers to cause a denial of service or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware version 1.01.07 allows authenticated attackers to compromise device integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-2929

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: This is a stack-based buffer overflow occurring in the sub_453140 function within the /boafrm/formWlAc endpoint. An authenticated attacker can trigger this vulnerability by sending a crafted HTTP POST request with an oversized submit-url parameter, which lacks necessary length validation.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service by crashing the device web server or causing an unexpected reboot, resulting in significant network downtime. Furthermore, the memory corruption can be leveraged to achieve arbitrary code execution with root privileges, potentially granting an attacker full control over the router and access to sensitive network traffic. The CVSS score of 8.8 reflects the high severity of this impact on network infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict administrative access to the device management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for recurrent crashes or unexpected service restarts, and inspect network traffic for unusually large POST requests directed at the /boafrm/formWlAc endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to drop HTTP requests containing excessively long parameters in the submit-url field, or disable the wireless access control configuration interface if it is not strictly required.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up linked in the CVE record.

Analyst Notes: As of February 23, 2026, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept has been published by the researcher, making the risk of exploitation credible. The reliance on unsafe C library functions like strcpy makes the target inherently susceptible to memory corruption attacks.

Analyst Recommendation

Given the high CVSS score and the availability of a published proof-of-concept, users of the D-Link DWR-M960 should treat this vulnerability with high priority. Organizations must implement strict network segmentation to limit access to the administrative interface and wait for official firmware remediation from the vendor.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: Hardware B1, Firmware V1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347275","name":"VDB-347275 | D-Link DWR-M960 WLAN Encryption Configuration Endpoint formWlEncrypt sub_452CCC stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347275","name":"VDB-347275 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754500","name":"Submit #754500 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/23","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.790Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 WLAN encryption endpoint allows remote attackers to cause a denial of service or potentially execute arbitrary code via a crafted HTTP request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware allows remote attackers to compromise device stability and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-2928

Affected Software: D-Link DWR-M960

Affected Versions: Hardware B1, Firmware V1.01.07

Vulnerability: The vulnerability exists in the /boafrm/formWlEncrypt endpoint, specifically within the sub_452CCC function, which performs an unsafe strcpy operation on the submit-url parameter. An attacker with low privileges can trigger this memory corruption to crash the web server or hijack execution flow.

Business Impact

The exploitation of this flaw can result in a complete denial of service, rendering the network gateway unreachable and disrupting business operations. Given the CVSS score of 8.8, the potential for arbitrary code execution with root privileges poses a severe risk to network integrity and confidentiality, as an attacker could gain persistent control over the networking infrastructure.

Remediation Plan

Immediate Action: Since no patch is explicitly identified, users should restrict administrative access to the device management interface to trusted internal segments only and monitor for firmware updates from the vendor.

Proactive Monitoring: Security teams should monitor network access logs for anomalous POST requests directed at the /boafrm/formWlEncrypt endpoint, particularly those containing unusually long parameter strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to filter and block HTTP requests containing malformed or excessively long submit-url parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published write-up on GitHub.

Analyst Notes: As of February 27, 2026, there is no confirmed active exploitation in the wild, but a published proof-of-concept exists, making the exploitation risk credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

This vulnerability represents a significant risk to the security of D-Link DWR-M960 routers. Organizations should prioritize isolating these devices from external networks and strictly limiting management access until a vendor-supplied security update is applied. Monitoring for the specific exploitation pattern identified in the proof-of-concept is essential until the underlying software flaw is remediated.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: 1.01.07
CONFIDENCE: high
MISSING: none
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347274","name":"VDB-347274 | D-Link DWR-M960 Operation Mode Configuration Endpoint formOpMode sub_462590 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347274","name":"VDB-347274 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754499","name":"Submit #754499 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/22","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.794Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the D-Link DWR-M960 firmware version 1.01.07, allowing remote attackers to crash the device or execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DWR-M960 router allows remote attackers to compromise device stability or gain unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-2927

Affected Software: D-Link DWR-M960

Affected Versions: 1.01.07

Vulnerability: This is a stack-based buffer overflow occurring within the sub_462590 function of the Operation Mode configuration endpoint (/boafrm/formOpMode). By sending a crafted POST request with an oversized submit-url parameter, a remote, authenticated attacker can trigger memory corruption due to unsafe usage of the strcpy function.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. An attacker could trigger a Denial of Service (DoS) by crashing the web service or potentially achieve remote code execution with root-level privileges, leading to full device compromise. Given the CVSS score of 8.8, this vulnerability is considered High severity, and the ability to control network traffic through a compromised router represents a significant threat to internal data confidentiality and integrity.

Remediation Plan

Immediate Action: Users should check the D-Link support portal for the latest firmware updates and apply them immediately to address the insecure memory handling in the configuration endpoint.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /boafrm/formOpMode endpoint, especially those containing unusually large payloads in the submit-url parameter.

Compensating Controls: If a patch is not immediately available, restrict access to the web management interface to trusted administrative IP addresses only, or place the device behind a restrictive firewall to limit exposure to untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept has been published in the linked research write-up, elevating the risk of exploitation. The flaw is inherently dangerous due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

The vulnerability in the D-Link DWR-M960 represents a high-risk security flaw that could lead to full system takeover. Organizations utilizing this hardware should prioritize applying vendor-supplied security updates to remediate the buffer overflow. If patching is delayed, immediate network segmentation and restricted access to the management interface are necessary to prevent unauthorized exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960 Hardware B1, Firmware V1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347273","name":"VDB-347273 | D-Link DWR-M960 LTE Configuration Endpoint formLteSetup sub_4237AC stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347273","name":"VDB-347273 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754498","name":"Submit #754498 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/21","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.794Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the D-Link DWR-M960 LTE configuration endpoint, allowing remote attackers to potentially crash the device or execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows remote, authenticated attackers to cause denial of service or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-2926

Affected Software: D-Link DWR-M960

Affected Versions: Hardware B1, Firmware V1.01.07

Vulnerability: The vulnerability is located in the sub_4237AC function within the /boafrm/formLteSetup endpoint. By sending a crafted POST request with an oversized submit-url parameter, an authenticated attacker can trigger a buffer overflow due to the unsafe use of the strcpy function.

Business Impact

Successful exploitation of this flaw poses a severe risk to network availability and integrity. Because the vulnerability allows for memory corruption, an attacker can crash the web server, leading to a denial of service that disrupts internet connectivity for all users on the network. Furthermore, the potential for arbitrary code execution with root-level privileges could allow an attacker to gain full control over the router, facilitating man-in-the-middle attacks or lateral movement within the local network. The CVSS score of 8.8 reflects the high severity of this remote code execution capability.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formLteSetup endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or truncate excessively long submit-url parameters in POST requests sent to the router.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published write-up on GitHub.

Analyst Notes: As of February 26, 2026, there is no confirmed active exploitation in the wild; however, because a published proof-of-concept exists (linked via the researcher's technical write-up), the exploitation risk is credible. The flaw is inherently dangerous due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

Given the high CVSS score and the public availability of technical details and proof-of-concept code, this vulnerability should be treated with high priority. Organizations using D-Link DWR-M960 routers must immediately isolate the management interface from the public internet and monitor for firmware update availability from the vendor to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: Hardware B1, Firmware V1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347272","name":"VDB-347272 | D-Link DWR-M960 Bridge VLAN Configuration Endpoint formBridgeVlan sub_42B5A0 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347272","name":"VDB-347272 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754497","name":"Submit #754497 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/20","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.794Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to crash the device or execute arbitrary code by supplying an oversized submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows for potential remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-2925

Affected Software: D-Link DWR-M960

Affected Versions: Hardware B1, Firmware V1.01.07

Vulnerability: The vulnerability exists in the Bridge VLAN configuration endpoint, specifically within the sub_42B5A0 function, due to the unsafe use of the strcpy function when handling the submit-url parameter. An attacker with low privileges can trigger this memory corruption by sending a crafted HTTP POST request to the device.

Business Impact

A successful exploit of this vulnerability could lead to a complete denial of service, rendering the network infrastructure unusable. More critically, the potential for arbitrary code execution with root-level privileges poses a severe risk of unauthorized access to sensitive internal network traffic and total device compromise. With a CVSS score of 8.8, this vulnerability represents a high-severity threat to business continuity and data security.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch for this vulnerability; users should restrict management interface access to trusted internal networks only and disable remote administration features until an official firmware update is released.

Proactive Monitoring: Monitor device logs for unexpected reboots or service crashes, and inspect network traffic for anomalous HTTP POST requests directed toward the /boafrm/formBridgeVlan endpoint.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface and filter requests containing excessively long URL parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher LX-66-LX via their GitHub technical write-up.

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild, but the availability of a public proof-of-concept makes the risk of exploitation credible. The flaw is inherently exploitable as it originates from a classic memory safety error in a widely accessible configuration endpoint.

Analyst Recommendation

Given the high CVSS score and the public availability of a proof-of-concept, this vulnerability should be treated with high priority. Organizations using the affected D-Link hardware must immediately isolate the management interface and maintain vigilance for vendor security updates to mitigate the risk of remote code execution.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347179","name":"VDB-347179 | D-Link DWR-M960 formIpv6Setup sub_469104 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347179","name":"VDB-347179 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754496","name":"Submit #754496 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/19","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows remote attackers to cause a denial of service or potentially execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows remote attackers to compromise device stability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-2885

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: The vulnerability exists within the function sub_469104 of the /boafrm/formIpv6Setup endpoint, where the application uses an unsafe strcpy operation to process the submit-url parameter. This flaw allows an authenticated user to trigger a stack-based buffer overflow by providing an oversized input string, potentially leading to memory corruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. By crashing the device, an attacker can cause significant denial of service for all users relying on the router for connectivity. Furthermore, the potential for arbitrary code execution with root-level privileges could allow an attacker to gain full control over the network gateway, leading to complete data interception and unauthorized access to internal resources. With a CVSS score of 8.8, this vulnerability is categorized as High, reflecting the significant potential for impact on operational continuity.

Remediation Plan

Immediate Action: Since no official vendor patch is currently confirmed, administrators should restrict access to the device management interface to trusted internal networks only. Monitor official D-Link support channels for firmware updates and apply them immediately upon release.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the /boafrm/formIpv6Setup endpoint, particularly those containing unusually long string parameters.

Compensating Controls: If the management interface must remain accessible, implement strict IP-based access control lists (ACLs) to limit interaction with the router configuration panel to authorized administrative workstations.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in a security research repository (referenced via the CVE record).

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the user-supplied input.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability requires urgent attention. Organizations utilizing the D-Link DWR-M960 should move to isolate the administration interface from the public internet immediately. Prioritize the application of any forthcoming firmware updates provided by D-Link to permanently remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: none
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347178","name":"VDB-347178 | D-Link DWR-M960 WAN Interface Setting formWanConfigSetup sub_41914C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347178","name":"VDB-347178 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754493","name":"Submit #754493 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/18","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 WAN interface configuration handler allows remote attackers to cause a denial of service or potentially execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DWR-M960 router, identified as CVE-2026-2884, poses a significant risk of remote code execution and system instability.

Vulnerability Details

CVE-ID: CVE-2026-2884

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: This vulnerability is a stack-based buffer overflow located in the function sub_41914C of the /boafrm/formWanConfigSetup endpoint. An authenticated attacker can trigger the flaw by sending a crafted HTTP POST request with an oversized submit-url parameter, which lacks necessary length validation before being copied into a fixed-size buffer.

Business Impact

The exploitation of this vulnerability allows for severe system compromise, including the potential for arbitrary code execution with root-level privileges. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, as it could lead to unauthorized network access, complete loss of router availability, or the use of the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Update the D-Link DWR-M960 firmware to the latest available version provided by the vendor to patch the buffer overflow vulnerability.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /boafrm/formWanConfigSetup endpoint and review system logs for recurring web server crashes or unexpected reboots.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and restrict the length of parameters in HTTP requests, specifically targeting the submit-url field to block oversized payloads.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the use of an unsafe string copy operation that directly impacts memory control.

Analyst Recommendation

Due to the high severity of this vulnerability and the availability of a public proof-of-concept, immediate remediation is required. Administrators should prioritize patching the affected DWR-M960 devices to prevent unauthorized access or system-wide denial of service. If a patch cannot be applied immediately, restrict administrative access to the web interface to trusted internal segments only.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: 1.01.07
CONFIDENCE: high
MISSING: none
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347177","name":"VDB-347177 | D-Link DWR-M960 formIpQoS sub_427D74 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347177","name":"VDB-347177 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754490","name":"Submit #754490 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/17","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 QoS configuration endpoint allows remote attackers to cause a denial of service or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware version 1.01.07 exposes the device to remote code execution and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-2883

Affected Software: D-Link DWR-M960

Affected Versions: 1.01.07

Vulnerability: The vulnerability exists in the /boafrm/formIpQoS endpoint within the sub_427D74 function. By sending a crafted POST request with an oversized submit-url parameter, an authenticated user can trigger a stack-based buffer overflow due to the unsafe use of the strcpy function.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the device web server, leading to a denial of service, or potentially hijack the device execution flow to run arbitrary code with root-level privileges. Given the CVSS score of 8.8, this vulnerability poses a high risk to network infrastructure, as it could be leveraged to gain persistence or facilitate further lateral movement within the network.

Remediation Plan

Immediate Action: Check the D-Link support portal for the latest firmware updates and apply them immediately to the affected DWR-M960 devices.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /boafrm/formIpQoS and watch for unexpected device reboots or service outages.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses and employ a WAF or intrusion detection system to filter oversized or malformed HTTP POST parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the researcher's published write-up (GitHub).

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the binary lacks proper bounds checking on the input parameter.

Analyst Recommendation

The presence of a published proof-of-concept combined with the potential for arbitrary code execution necessitates immediate attention. Administrators should prioritize patching the affected firmware versions to eliminate the underlying memory corruption flaw and prevent unauthorized control over the device.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347176","name":"VDB-347176 | D-Link DWR-M960 formDosCfg sub_46385C stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347176","name":"VDB-347176 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754487","name":"Submit #754487 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/16","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 router allows authenticated attackers to trigger a denial of service or potentially execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware version 1.01.07 poses a severe risk of system compromise or device instability.

Vulnerability Details

CVE-ID: CVE-2026-2882

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: The vulnerability exists in the /boafrm/formDosCfg endpoint due to unsafe usage of the strcpy function within the sub_46385C function. An attacker with low-level privileges can supply an oversized submit-url parameter during a save operation to trigger memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service, rendering the device unreachable and disrupting network connectivity for all dependent users. Furthermore, because the web server typically runs with root privileges, the memory corruption can be leveraged to achieve arbitrary code execution, granting an attacker full control over the router and potential access to the internal network. Given the CVSS score of 8.8, this flaw represents a high-severity threat to infrastructure integrity.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at /boafrm/formDosCfg that contain excessively long parameters.

Compensating Controls: Implement access control lists (ACLs) to limit management access to known, trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up by LX-66-LX on GitHub.

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the input parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high potential for arbitrary code execution, this vulnerability poses a significant risk to organizational security. Administrators must prioritize isolating the affected management interfaces from external access immediately. Continue to monitor official D-Link support channels for firmware updates that address this stack-based buffer overflow and apply them as soon as they become available.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347175","name":"VDB-347175 | D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub_425FF8 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347175","name":"VDB-347175 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754486","name":"Submit #754486 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/15","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 firewall configuration endpoint allows authenticated attackers to trigger a device crash or potentially execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DWR-M960 router enables authenticated attackers to compromise system stability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-2881

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: This flaw is a stack-based buffer overflow located in the sub_425FF8 function of the /boafrm/formFirewallAdv endpoint. An authenticated attacker can trigger the overflow by sending a crafted POST request with an oversized submit-url parameter, leading to memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a complete Denial of Service, rendering the network device unreachable and disrupting critical business communications. Furthermore, the potential for arbitrary code execution with root-level privileges poses a severe risk of total device takeover, allowing attackers to intercept traffic or pivot into the internal network. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate remediation.

Remediation Plan

Immediate Action: Contact D-Link support or check the official firmware portal for an available security patch for hardware version B1, as no public fix is currently confirmed.

Proactive Monitoring: Monitor device access logs for unusual POST requests directed at the /boafrm/formFirewallAdv endpoint, particularly those containing abnormally long strings in the submit-url parameter.

Compensating Controls: Restrict access to the router web management interface to trusted administrative IP addresses only, and utilize a network-based firewall to block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a researcher's GitHub repository.

Analyst Notes: As of February 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the submit-url parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for root-level code execution, this vulnerability represents a significant risk to organizational infrastructure. Administrators should prioritize restricting administrative access to the affected hardware and verifying the current firmware status with the vendor. Applying the necessary security updates as soon as they are released by D-Link is essential to maintaining network integrity.

---METADATA---
VENDOR: D-Link
PRODUCT: DWR-M960
AFFECTED_VERSIONS: D-Link DWR-M960: 1.01.07
CONFIDENCE: high
MISSING: patch
CREDITS: LX-66-LX (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.347096","name":"VDB-347096 | D-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub_423E00 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.347096","name":"VDB-347096 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.754476","name":"Submit #754476 | D-Link DWR-M960 V1.01.07 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/LX-66-LX/cve-new/issues/14","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.802Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DWR-M960 port forwarding configuration allows remote attackers to trigger memory corruption via the submit-url parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers poses a severe risk of remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-2857

Affected Software: D-Link DWR-M960

Affected Versions: D-Link DWR-M960: 1.01.07

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) located in the function sub_423E00 within the /boafrm/formPortFw file. An attacker with low-level privileges can trigger this memory corruption by manipulating the submit-url argument during port forwarding configuration.

Business Impact

The exploitation of this vulnerability can result in a total loss of system integrity and availability, as it allows for arbitrary code execution on the networking hardware. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, potentially enabling attackers to intercept network traffic, pivot into internal segments, or render the device unresponsive.

Remediation Plan

Immediate Action: Contact D-Link support or monitor the official D-Link security portal for the release of a firmware update that addresses the vulnerability in the port forwarding configuration.

Proactive Monitoring: Monitor network traffic for anomalous requests directed at the /boafrm/formPortFw endpoint and audit configuration logs for unauthorized modifications to port forwarding rules.

Compensating Controls: Restrict access to the router administrative interface to trusted management IP addresses only and disable remote management features if they are not required for business operations.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of February 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a publicly disclosed exploit script increases the likelihood that threat actors will attempt to weaponize this memory corruption flaw.