CVE-2026-90702

D-Link DWR-M921 formDiskFormat system os command injection

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dwr-m921

CVE-2026-90706

D-Link DWR-M921 formWsc os command injection

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS 2.3% KEV · Not listed

Vendors

D-link

Products

Dwr-m921

CVE-2026-90704

D-Link DWR-M921 formDiskPartition system command injection

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVSS 4.0 · 5.1 Medium EPSS 2.3% KEV · Not listed

Vendors

D-link

Products

Dwr-m921

CVE-2026-90699

D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dwr-m920

CVE-2026-86509

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-895l

CVE-2026-86297

D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname  leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

CVSS 4.0 · 9.2 Critical EPSS 1.1% KEV · Not listed

Vendors

D-link

Products

Dir-605

CVE-2026-86510

D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-822a

CVE-2026-86296

D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed

Vendors

D-link

Products

Dir-822a

CVE-2026-86295

D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS 2.3% KEV · Not listed

Vendors

D-link

Products

Dir-895l

CVE-2026-85224

D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-320 Sharecenter Dns-343 Sharecenter

CVE-2026-85223

D-Link DNS-340L CGI dropbox.cgi os command injection

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dns-340l

CVE-2026-85222

D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-340l

CVE-2026-82691

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-320l Dns-327l Dns-340l and 1 more

CVE-2026-82688

D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-340l Dns-345

CVE-2026-82593

D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-82595

D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS 4.4% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-82592

D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-82689

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dns-320l Dns-327l Dns-340l and 1 more

CVE-2026-82692

D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dns-340l Dns-345

CVE-2026-82690

D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-327l Dns-340l