Coverage of CVEs, patches, and active exploitation affecting D-Link networking hardware including SOHO routers, 4G LTE gateways, and access points. D-Link devices are widely deployed in home and small business networks, and firmware vulnerabilities in the DWR, DSL, and DIR series recur across successive models. Combined article + CVE feed for the D-Link beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-09-16-d-link-dwr-m921-m920-command-injection-three-cves/https://0daynews.com/articles/2026-09-16-d-link-dwr-m921-m920-command-injection-three-cves/Three critical command injection flaws in D-Link DWR-M920 and DWR-M921 firmware. Researcher H3rmesk1t disclosed all three; no D-Link patch available.Wed, 16 Sep 2026 16:00:00 GMTD-Linkarticlehttps://0daynews.com/cve/cve-2011-4723/https://0daynews.com/cve/cve-2011-4723/The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.Wed, 16 Sep 2026 00:00:00 GMTD-Linkmediumcvehttps://0daynews.com/cve/cve-2013-5223/https://0daynews.com/cve/cve-2013-5223/A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.Wed, 16 Sep 2026 00:00:00 GMTD-Linkmediumcvehttps://0daynews.com/cve/cve-2014-100005/https://0daynews.com/cve/cve-2014-100005/D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2015-2051/https://0daynews.com/cve/cve-2015-2051/D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2016-11021/https://0daynews.com/cve/cve-2016-11021/setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2016-20017/https://0daynews.com/cve/cve-2016-20017/D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2018-6530/https://0daynews.com/cve/cve-2018-6530/Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2019-16057/https://0daynews.com/cve/cve-2019-16057/The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2019-16920/https://0daynews.com/cve/cve-2019-16920/Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2019-17621/https://0daynews.com/cve/cve-2019-17621/D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2019-20500/https://0daynews.com/cve/cve-2019-20500/D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2020-25078/https://0daynews.com/cve/cve-2020-25078/D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2020-25079/https://0daynews.com/cve/cve-2020-25079/D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2020-25506/https://0daynews.com/cve/cve-2020-25506/D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2020-29557/https://0daynews.com/cve/cve-2020-29557/D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2020-9377/https://0daynews.com/cve/cve-2020-9377/D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2021-40655/https://0daynews.com/cve/cve-2021-40655/D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2021-45382/https://0daynews.com/cve/cve-2021-45382/A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2022-26258/https://0daynews.com/cve/cve-2022-26258/D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2022-37055/https://0daynews.com/cve/cve-2022-37055/D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2022-40799/https://0daynews.com/cve/cve-2022-40799/D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2023-25280/https://0daynews.com/cve/cve-2023-25280/D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2024-0769/https://0daynews.com/cve/cve-2024-0769/D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.Wed, 16 Sep 2026 00:00:00 GMTD-Linkmediumcvehttps://0daynews.com/cve/cve-2024-3272/https://0daynews.com/cve/cve-2024-3272/D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2024-3273/https://0daynews.com/cve/cve-2024-3273/D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2025-29635/https://0daynews.com/cve/cve-2025-29635/D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Wed, 16 Sep 2026 00:00:00 GMTD-Linkhighcvehttps://0daynews.com/cve/cve-2026-90699/https://0daynews.com/cve/cve-2026-90699/D-Link DWR-M920 firmware 1.1.7 passes the newPin argument from /boafrm/formPinManageSetup directly to the system shell, allowing OS command injection. CVSS 9.9 critical.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2026-90702/https://0daynews.com/cve/cve-2026-90702/D-Link DWR-M921 firmware 1.1.52 passes the partition argument from /boafrm/formDiskFormat to the system shell without sanitization, enabling OS command injection. CVSS 9.1 critical.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcvehttps://0daynews.com/cve/cve-2026-90703/https://0daynews.com/cve/cve-2026-90703/D-Link DWR-M921 firmware 1.1.52 passes the folderpath argument from /boafrm/formDiskCreateShare to the system shell without sanitization, enabling OS command injection. CVSS 9.1 critical.Wed, 16 Sep 2026 00:00:00 GMTD-Linkcriticalcve