Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2024-3273 — D-Link Multiple NAS Devices Command Injection Vulnerability
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
|
D-Link | Multiple NAS Devices | Apr 11, 2024 | May 2, 2024 | |
|
CVE-2016-20017 — D-Link DSL-2750B Devices Command Injection Vulnerability
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
|
D-Link | DSL-2750B Devices | Jan 8, 2024 | Jan 29, 2024 | |
|
CVE-2019-17621 — D-Link DIR-859 Router Command Execution Vulnerability
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
|
D-Link | DIR-859 Router | Jun 29, 2023 | Jul 20, 2023 | |
|
CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
|
D-Link | DWL-2600AP Access Point | Jun 29, 2023 | Jul 20, 2023 | |
|
CVE-2011-4723 — D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
|
D-Link | DIR-300 Router | Sep 8, 2022 | Sep 29, 2022 | |
|
CVE-2018-6530 — D-Link Multiple Routers OS Command Injection Vulnerability
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
|
D-Link | Multiple Routers | Sep 8, 2022 | Sep 29, 2022 | Ransomware |
|
CVE-2022-26258 — D-Link DIR-820L Remote Code Execution Vulnerability
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
|
D-Link | DIR-820L | Sep 8, 2022 | Sep 29, 2022 | |
|
CVE-2019-16057 — D-Link DNS-320 Remote Code Execution Vulnerability
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
|
D-Link | DNS-320 Storage Device | Apr 15, 2022 | May 6, 2022 | Ransomware |
|
CVE-2021-45382 — D-Link Multiple Routers Remote Code Execution Vulnerability
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
|
D-Link | Multiple Routers | Apr 4, 2022 | Apr 25, 2022 | |
|
CVE-2013-5223 — D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
|
D-Link | DSL-2760U | Mar 25, 2022 | Apr 15, 2022 |
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Multiple NAS Devices · Apr 11, 2024
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
DSL-2750B Devices · Jan 8, 2024
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
DIR-859 Router · Jun 29, 2023
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
DWL-2600AP Access Point · Jun 29, 2023
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
DIR-300 Router · Sep 8, 2022
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
Multiple Routers · Sep 8, 2022
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
DIR-820L · Sep 8, 2022
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
DNS-320 Storage Device · Apr 15, 2022
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Multiple Routers · Apr 4, 2022
A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
DSL-2760U · Mar 25, 2022