D-Link vulnerabilities
Coverage of CVEs, patches, and active exploitation affecting D-Link networking hardware including SOHO routers, 4G LTE gateways, and access points. D-Link devices are widely deployed in home and small business networks, and firmware vulnerabilities in the DWR, DSL, and DIR series recur across successive models.
We track 30 D-Link CVEs, 26 of them on CISA's Known Exploited Vulnerabilities catalog (2 flagged for ransomware use). The latest KEV addition is CVE-2025-29635, added .
- CVEs tracked
- 30
- On CISA KEV
- 26
- Ransomware use
- 2
- Rated critical
- 16
Latest D-Link coverage
Our reporting filed under D-Link, plus any story that cites one of its CVEs.
UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8
CVE-2026-66086: Stack overflow in UNISOC modem OTA stack triggered by malformed LTE SIB1 messages. Remote code execution possible with no user interaction.
D-Link Warns CVSS 10.0 DIR-822A Flaw Has No Fix
CVE-2026-86296: CVSS 10.0 D-Link DIR-822A zero-day with public PoC exploit code and no patch. D-Link says the device is end-of-life and replacement is needed.
D-Link DWR Routers Hit by Three Critical Command Injections
Three critical command injection flaws in D-Link DWR-M920 and DWR-M921 firmware. Researcher H3rmesk1t disclosed all three; no D-Link patch available.
Known exploited D-Link vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2025-29635 D-Link DIR-823X Command Injection Vulnerability | [ HIGH ] | 7.2 | 87.9% | ||
| CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 55.5% | ||
| CVE-2022-40799 D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | [ HIGH ] | 8.8 | 33.7% | ||
| CVE-2020-25079 D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability | [ HIGH ] | 8.8 | 54.0% | ||
| CVE-2020-25078 D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability | [ HIGH ] | 7.5 | 97.5% | ||
| CVE-2024-0769 D-Link DIR-859 Router Path Traversal Vulnerability | [ MEDIUM ] | 5.3 | 82.7% | ||
| CVE-2023-25280 D-Link DIR-820 Router OS Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 97.9% | ||
| CVE-2021-40655 D-Link DIR-605 Router Information Disclosure Vulnerability | [ HIGH ] | 7.5 | 87.0% | ||
| CVE-2014-100005 D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | [ HIGH ] | 8.0 | 43.5% | ||
| CVE-2024-3273 D-Link Multiple NAS Devices Command Injection Vulnerability | [ HIGH ] | 7.3 | 100.0% | ||
| CVE-2024-3272 D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | [ CRITICAL ] | 9.8 | 98.1% | ||
| CVE-2016-20017 D-Link DSL-2750B Devices Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 65.8% | ||
| CVE-2019-20500 D-Link DWL-2600AP Access Point Command Injection Vulnerability | [ HIGH ] | 7.8 | 96.7% | ||
| CVE-2019-17621 D-Link DIR-859 Router Command Execution Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | ||
| CVE-2022-26258 D-Link DIR-820L Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 91.6% | ||
| CVE-2018-6530 D-Link Multiple Routers OS Command Injection Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.7% | ||
| CVE-2011-4723 D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability | [ MEDIUM ] | 5.7 | 3.1% | ||
| CVE-2019-16057 D-Link DNS-320 Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 86.5% | ||
| CVE-2021-45382 D-Link Multiple Routers Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 97.8% | ||
| CVE-2020-9377 D-Link DIR-610 Devices Remote Command Execution | [ HIGH ] | 8.8 | 21.9% | ||
| CVE-2019-16920 D-Link Multiple Routers Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2016-11021 D-Link DCS-930L Devices OS Command Injection Vulnerability | [ HIGH ] | 7.2 | 69.6% | ||
| CVE-2013-5223 D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability | [ MEDIUM ] | 5.4 | 50.8% | ||
| CVE-2015-2051 D-Link DIR-645 Router Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 97.1% | ||
| CVE-2020-29557 D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 55.7% | ||
| CVE-2020-25506 D-Link DNS-320 Device Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 100.0% |
Every D-Link CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Other D-Link CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-86296 D-Link DIR-822A Maximum Severity Zero-Day Vulnerabilitywrite-up | [ CRITICAL ] | 10.0 | 2.4% | — |
| CVE-2026-90703 D-Link DWR-M921 command injection via disk share creation endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90702 D-Link DWR-M921 command injection via disk format endpointwrite-up | [ CRITICAL ] | 9.1 | 3.6% | — |
| CVE-2026-90699 D-Link DWR-M920 command injection via SIM PIN management endpointwrite-up | [ CRITICAL ] | 9.9 | 3.3% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/d-link.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.