D-Link Multiple Routers OS Command Injection Vulnerability
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
- Vendor
- D-Link
- Product
- Multiple Routers
- CVSS
- 9.8
- EPSS (exploit probability)
- 96.7%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2018-6530 being exploited?
Yes. CISA added CVE-2018-6530 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 96.7% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-24. Full cross-catalog view: /kev-comparison
CVE-2018-6530 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
CISA required actionThe vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other D-Link CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-86296 D-Link DIR-822A Maximum Severity Zero-Day Vulnerabilitywrite-up | [ CRITICAL ] | 10.0 | 1.7% | — |
| CVE-2026-90703 D-Link DWR-M921 command injection via disk share creation endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90702 D-Link DWR-M921 command injection via disk format endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90699 D-Link DWR-M920 command injection via SIM PIN management endpointwrite-up | [ CRITICAL ] | 9.9 | 3.3% | — |
| CVE-2025-29635 D-Link DIR-823X Command Injection Vulnerability | [ HIGH ] | 7.2 | 87.9% | |
| CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 55.5% | |
| CVE-2022-40799 D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | [ HIGH ] | 8.8 | 33.7% | |
| CVE-2020-25079 D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability | [ HIGH ] | 8.8 | 54.0% |