#D-Link
All CosmicBytez Labs articles tagged #D-Link, across news, security advisories, how-to guides, and projects.
- News
Hackers Hijack D-Link, Ubiquiti Devices to Resell Stolen Bandwidth
GreyNoise found 143 hijacked NAS, NVR, and SAP devices across 34 countries silently enrolled in the Pawns.app residential proxy network.
- Security
CVE-2026-108971: D-Link DCS-930L Firmware Signature Verification Bypass
A CVSS 9.6 flaw in D-Link DCS-930L cameras lets remote, unauthenticated attackers flash unsigned firmware via the recovery server.
- Security
D-Link DIR-895L L2TP Parser Out-of-Bounds Write (CVE-2026-100740)
A CVSS 9.9 pre-auth out-of-bounds write in D-Link DIR-895L's L2TP control-channel parser has a public PoC and no vendor patch.
- Security
CVE-2026-96891: D-Link DIR-825 rp-l2tp Out-of-Bounds Write Enables Remote Compromise
A critical, unauthenticated out-of-bounds write in D-Link DIR-825's L2TP tunnel handling has no patch — the router is end-of-life.
- News
D-Link Warns of Max Severity Zero-Day Bug in DIR-822A Routers
D-Link disclosed two unpatched flaws in legacy DIR-822A routers with public PoC exploit code, including a max-severity DHCP stack overflow.
- Security
CVE-2026-94089: Critical Unauthenticated Stack Overflow in D-Link DIR-868L Routers
A CVSS 10 stack-based buffer overflow in D-Link DIR-868L's authentication CGI lets unauthenticated remote attackers achieve full router compromise.
- Security
CVE-2026-93958: D-Link R95 (BE9500) Command Injection to Root RCE
A public PoC chains D-Link R95 BE9500 firmware 1.00.16's SetTimeSettings handler into authenticated command injection for root shell access.
- Security
CVE-2026-90699: D-Link DWR-M920 OS Command Injection via PIN Manage Setup
D-Link DWR-M920 1.1.7 lets remote attackers inject OS commands through the formPinManageSetup handler; a public exploit is already available.
- Security
CVE-2026-90702: D-Link DWR-M921 OS Command Injection via Disk Format Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskFormat handler; a public exploit is already available.
- Security
CVE-2026-90703: D-Link DWR-M921 OS Command Injection via Disk Share Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskCreateShare handler; a public exploit is already available.
- Security
Critical Stack Overflow in D-Link DIR-823G Routers (CVE-2026-90680)
An unauthenticated stack-based buffer overflow (CVSS 9.9) in D-Link DIR-823G's HNAP1 interface allows remote attackers to corrupt memory...
- Security
CVE-2026-85222: D-Link DNS-340L Command Injection Has No Fix Coming
An unauthenticated OS command injection in the DNS-340L's Add-On Center CGI grants root — and D-Link has declared the device end-of-life.
- Security
D-Link DIR-825M Disk-Format Stack Overflow (CVE-2026-82592)
CVE-2026-82592 is a critical, unauthenticated stack overflow in D-Link DIR-825M's disk-formatting endpoint, with a public exploit available.
- Security
D-Link DIR-825M LTE Upgrade Stack Overflow (CVE-2026-82593)
CVE-2026-82593 is a critical, unauthenticated stack overflow in D-Link DIR-825M's LTE firmware-upgrade handler, with a public exploit available.
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Quectel)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Fibocom)
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the fota_url...
- Security
D-Link DWR-M961 Command Injection via Ping Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host parameter...
- Security
D-Link DWR-M961 Command Injection via Traceroute Diagnostic Interface
A command injection vulnerability in D-Link DWR-M961 routers (hardware C1) allows remote attackers to execute arbitrary OS commands via the host and ipVer...
- Security
CVE-2026-71948: D-Link DWR-M961 Command Injection via formDebugDiagnosticRun
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote attackers to execute arbitrary commands via the host...
- Security
CVE-2026-71949: D-Link DWR-M961 Command Injection via formUSSDSetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers enables remote code execution through the ussdValue and...
- Security
CVE-2026-71950: D-Link DWR-M961 Command Injection via formSmsManage
A critical unauthenticated command injection in the D-Link DWR-M961 SMS management interface allows remote attackers to execute arbitrary OS commands via...
- Security
CVE-2026-71951: D-Link DWR-M961 Command Injection via formIMEISetup
A critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers allows remote code execution by injecting OS commands into the...
- News
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
Researchers at QiAnXin's XLab have identified AryStinger, a novel malware targeting end-of-life D-Link routers and QNAP NAS devices to build a distributed...
- News
AryStinger Botnet Infected Thousands of D-Link Routers Worldwide
A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated D-Link routers, converting them into malicious proxy...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- Security
CVE-2025-29635: D-Link DIR-823X Command Injection
A command injection flaw in end-of-life D-Link DIR-823X routers allows authenticated remote attackers to execute arbitrary OS commands. CISA has added...
- News
New Mirai Campaign Exploits RCE Flaw in End-of-Life D-Link
A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability in end-of-life D-Link DIR-823X...
- Security
D-Link DHP-1320 SOAP Handler Stack Buffer Overflow
A CVSS 8.8 stack-based buffer overflow in D-Link DHP-1320 firmware 1.00WWB04 allows unauthenticated remote attackers to execute arbitrary code via a...
- Security
Critical D-Link Router RCE Under Active Exploitation - No
CVE-2026-0625 allows unauthenticated remote code execution on legacy D-Link DSL routers. Devices are end-of-life with no patches forthcoming. Immediate...