Sourced tracker
D-Link router vulnerabilities exploited in the wild
18 D-Link flaws that CISA lists as actively exploited, with what D-Link says about each: the firmware that fixes it, or that the model is retired and will not be patched.
Exploited D-Link flaws, newest first
| Vulnerability | Added to KEV | Vendor status and models | Source |
|---|---|---|---|
| CVE-2025-29635D-Link DIR-823X Command Injection Vulnerability | 24 Apr 2026 | Replace: no fixDIR-823X (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2022-37055D-Link Routers Buffer Overflow Vulnerability | 8 Dec 2025 | Replace: no fixGO-RT-AC750 (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2024-0769 D-Link DIR-859 Router Path Traversal Vulnerability | 25 Jun 2025 | Replace: no fixDIR-859 (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2023-25280D-Link DIR-820 Router OS Command Injection Vulnerability | 30 Sep 2024 | Replace: no fixDIR-820L (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2021-40655D-Link DIR-605 Router Information Disclosure Vulnerability | 16 May 2024 | Replace: no fixDIR-605 (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2014-100005D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | 16 May 2024 | FixedDIR-600 Rev. BxFix: 2.17b02 | VendorRead 18 Oct 2026 |
| CVE-2016-20017D-Link DSL-2750B Devices Command Injection Vulnerability | 8 Jan 2024 | FixedDSL-2750B Rev DxFix: EU_1.05 | VendorRead 18 Oct 2026 |
| CVE-2019-20500D-Link DWL-2600AP Access Point Command Injection Vulnerability | 29 Jun 2023 | FixedDWL-2600AP Rev AFix: 4.2.0.17 | VendorRead 18 Oct 2026 |
| CVE-2019-17621D-Link DIR-859 Router Command Execution Vulnerability | 29 Jun 2023 | FixedDIR-859 (Ax)Fix: 1.07b03 beta | VendorRead 18 Oct 2026 |
| CVE-2022-26258D-Link DIR-820L Remote Code Execution Vulnerability | 8 Sep 2022 | Replace: no fixDIR-820L (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2018-6530D-Link Multiple Routers OS Command Injection Vulnerability | 8 Sep 2022Used in ransomware | FixedDIR-860L Rev. A, DIR-865L Rev. A, DIR-868L Rev. A, DIR-880L Rev. AFix: beta builds: DIR-860L 1.11b01, DIR-865L 1.10b01, DIR-868L 1.20b01, DIR-880L 1.08b06 | VendorRead 18 Oct 2026 |
| CVE-2011-4723D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability | 8 Sep 2022 | Vendor statement not verifiedDIR-300 Router | Checked against KEV |
| CVE-2021-45382D-Link Multiple Routers Remote Code Execution Vulnerability | 4 Apr 2022 | Replace: no fixDIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, DIR-836L | VendorRead 18 Oct 2026 |
| CVE-2020-9377D-Link DIR-610 Devices Remote Command Execution | 25 Mar 2022 | Replace: no fixDIR-610 Rev. Ax | VendorRead 18 Oct 2026 |
| CVE-2019-16920D-Link Multiple Routers Command Injection Vulnerability | 25 Mar 2022 | Replace: no fixDIR-655 Rev Cx, DIR-866L Rev Ax, DIR-652 Rev Bx, DHP-1565 Rev Ax, DAP-1533 Rev Ax, DGL-5500 Rev Ax, DIR-130 Rev Ax, DIR-330 Rev Ax, DIR-615 Rev Ix, DIR-825 Rev Cx, DIR-835 Rev Ax, DIR-855L Rev Ax, DIR-862 Rev Ax | VendorRead 18 Oct 2026 |
| CVE-2013-5223D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability | 25 Mar 2022 | FixedDSL-2760U (HW E1)Fix: 1.12 | VendorRead 18 Oct 2026 |
| CVE-2015-2051D-Link DIR-645 Router Remote Code Execution Vulnerability | 10 Feb 2022 | Replace: no fixDIR-645 (all hardware revisions) | VendorRead 18 Oct 2026 |
| CVE-2020-29557D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | 3 Nov 2021 | FixedDIR-825/R1Fix: 3.0.2 | VendorRead 18 Oct 2026 |
Is your D-Link model still supported?
D-Link's US archive of end-of-support products; its security notices point owners here.
D-Link end-of-life list Read 18 Oct 2026
What to do
- Find the model and hardware version on the label under the router.
- If the row says fixed, install that firmware or newer from D-Link’s own support site.
- If it says replace, the vendor will not patch it: a router exposed to the internet with a flaw attackers already use should be taken offline and replaced.
- Turn off remote management from the internet unless you need it.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. We copy CISA’s entry and re-check the catalog every week.
- The vendor status comes from the vendor’s own advisory or end-of-life notice, tied to a short sentence on that page that a script re-reads weekly.
- “Replace: no fix” means the vendor has said the model will not be patched. A router in that state stays open to the flaw for as long as it is online.
- Check the exact model and hardware version on the label under the router; vendors often fix one hardware version and retire another.
Other brands: ASUS · Cisco Small Business · DrayTek · MikroTik · NETGEAR · Tenda · TP-Link · Ubiquiti · Zyxel · All routers