{ "name": "Exploited router vulnerabilities", "description": "Home and small-office router entries of the CISA KEV catalog, with the vendor's fix or end-of-life statement where the vendor published one.", "license": "https://creativecommons.org/licenses/by/4.0/", "rights": "Catalog rows are copied from CISA's KEV catalog, which is public domain (CC0); the vendor statements and the arrangement are MyIPScan's (CC BY 4.0).", "attribution": "MyIPScan (https://myipscan.net/routers/); quoted evidence belongs to its source", "page": "https://myipscan.net/routers/", "url": "https://myipscan.net/routers/kev.json", "dateModified": "2026-10-16", "records": 61, "data": { "catalogVersion": "2026.10.16", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "entries": [ { "cveID": "CVE-2021-32030", "vendorProject": "ASUS", "product": "Routers", "vulnerabilityName": "ASUS Routers Improper Authentication Vulnerability", "dateAdded": "2025-06-02", "shortDescription": "ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/ ; https://www.asus.com/us/supportonly/rog%20rapture%20gt-ac2900/helpdesk_bios/; https://nvd.nist.gov/vuln/detail/CVE-2021-32030", "vendor": "asus", "page": "https://myipscan.net/routers/asus/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2021-32030", "models": [ "GT-AC2900", "Lyra mini" ], "status": "end_of_life", "as_of": "2026-10", "note": "No ASUS advisory for this CVE; both models are on ASUS's end-of-life list.", "evidence": "no longer manufactured or updated with firmware and documentation", "source_url": "https://www.asus.com/event/network/EOL-product/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-39780", "vendorProject": "ASUS", "product": "RT-AX55 Routers", "vulnerabilityName": "ASUS RT-AX55 Routers OS Command Injection Vulnerability", "dateAdded": "2025-06-02", "shortDescription": "ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.asus.com/networking-iot-servers/wifi-6/all-series/rt-ax55/helpdesk_bios/?model2Name=RT-AX55 ; https://www.asus.com/content/asus-product-security-advisory/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-39780", "vendor": "asus", "page": "https://myipscan.net/routers/asus/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-39780", "models": [ "RT-AX55" ], "status": "not_stated", "note": "Not in ASUS's security advisory feed. RT-AX55 is not on the end-of-life list.", "source_url": "https://security-advisory-api.asus.com/rss/securityrss.xml", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-1653", "vendorProject": "Cisco", "product": "Small Business RV320 and RV325 Routers", "vulnerabilityName": "Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-1653", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-1653", "models": [ "RV320", "RV325" ], "status": "fixed", "fixed_in": "1.4.2.22", "as_of": "2019-01-23", "note": "The first fix was incomplete. Both models passed their last date of support on 31 Jan 2025.", "evidence": "The complete fix is now available in Firmware Release 1.4.2.22.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-1652", "vendorProject": "Cisco", "product": "Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers", "vulnerabilityName": "Cisco Small Business Routers Improper Input Validation Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-1652", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-1652", "models": [ "RV320", "RV325" ], "status": "fixed", "fixed_in": "1.4.2.22", "as_of": "2019-01-23", "note": "Command injection; the first fix was incomplete.", "evidence": "available in Firmware Release 1.4.2.22.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-20699", "vendorProject": "Cisco", "product": "Small Business RV160, RV260, RV340, and RV345 Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-20699", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-20699", "models": [ "RV340", "RV340W", "RV345", "RV345P" ], "status": "fixed", "fixed_in": "1.0.03.26", "as_of": "2022-02-02", "note": "Version from the advisory's first fixed release table.", "evidence": "Cisco has released software updates that address these vulnerabilities.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-20700", "vendorProject": "Cisco", "product": "Small Business RV160, RV260, RV340, and RV345 Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-20700", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-20700", "models": [ "RV160", "RV160W", "RV260", "RV260P", "RV260W", "RV340", "RV340W", "RV345", "RV345P" ], "status": "fixed", "fixed_in": "RV160/RV260 1.0.01.07; RV340/RV345 1.0.03.26", "as_of": "2022-02-02", "note": "Privilege escalation.", "evidence": "Cisco has released software updates that address these vulnerabilities.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-20701", "vendorProject": "Cisco", "product": "Small Business RV160, RV260, RV340, and RV345 Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-20701", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-20701", "models": [ "RV340", "RV340W", "RV345", "RV345P" ], "status": "fixed", "fixed_in": "1.0.03.26", "as_of": "2022-02-02", "note": "Privilege escalation.", "evidence": "Cisco has released software updates that address these vulnerabilities.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-20703", "vendorProject": "Cisco", "product": "Small Business RV160, RV260, RV340, and RV345 Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-20703", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-20703", "models": [ "RV160", "RV160W", "RV260", "RV260P", "RV260W", "RV340", "RV340W", "RV345", "RV345P" ], "status": "fixed", "fixed_in": "RV160/RV260 1.0.01.07; RV340/RV345 1.0.03.26", "as_of": "2022-02-02", "note": "Signature verification bypass.", "evidence": "Cisco has released software updates that address these vulnerabilities.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-20708", "vendorProject": "Cisco", "product": "Small Business RV160, RV260, RV340, and RV345 Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability", "dateAdded": "2022-03-03", "shortDescription": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-20708", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-20708", "models": [ "RV340", "RV340W", "RV345", "RV345P" ], "status": "fixed", "fixed_in": "1.0.03.26", "as_of": "2022-02-02", "note": "Command injection. These models now have end-of-life notices too.", "evidence": "Cisco has released software updates that address these vulnerabilities.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-15271", "vendorProject": "Cisco", "product": "RV Series Routers", "vulnerabilityName": "Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability", "dateAdded": "2022-06-08", "shortDescription": "A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-15271", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-15271", "models": [ "RV042", "RV042G" ], "status": "fixed", "fixed_in": "4.2.3.10", "as_of": "2019-11-06", "note": "Advisory updated in Dec 2022 after more attacks.", "evidence": "Cisco fixed this vulnerability in firmware releases 4.2.3.10 and later", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "kev_status", "cve": "CVE-2019-15271", "models": [ "RV016", "RV082" ], "status": "end_of_life", "as_of": "2019-11-06", "note": "No fixed release for these two models.", "evidence": "have reached the end of software maintenance.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-20118", "vendorProject": "Cisco", "product": "Small Business RV Series Routers", "vulnerabilityName": "Cisco Small Business RV Series Routers Command Injection Vulnerability", "dateAdded": "2025-03-03", "shortDescription": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5 ; https://nvd.nist.gov/vuln/detail/CVE-2023-20118", "vendor": "cisco-small-business", "page": "https://myipscan.net/routers/cisco-small-business/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-20118", "models": [ "RV016", "RV042", "RV042G", "RV082", "RV320", "RV325" ], "status": "end_of_life", "as_of": "2023-01-11", "note": "All releases affected, no workaround; turning off remote management only reduces exposure.", "evidence": "Cisco has not and will not release software updates that address this vulnerability.", "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-29557", "vendorProject": "D-Link", "product": "DIR-825 R1 Devices", "vulnerabilityName": "D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-29557", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-29557", "models": [ "DIR-825/R1" ], "status": "fixed", "fixed_in": "3.0.2", "as_of": "2020-11-20", "note": "D-Link Russia firmware changelog names the CVE.", "evidence": "Устранена уязвимость с переполнением буфера WEB-интерфейса в функции проверки версии браузера (CVE-2020-29557).", "source_url": "https://www.dlink.ru/ru/download2/5/19/2354/441/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2015-2051", "vendorProject": "D-Link", "product": "DIR-645 Router", "vulnerabilityName": "D-Link DIR-645 Router Remote Code Execution Vulnerability", "dateAdded": "2022-02-10", "shortDescription": "D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2015-2051", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2015-2051", "models": [ "DIR-645 (all hardware revisions)" ], "status": "end_of_life", "as_of": "2024-07-02", "note": "End of life since 31 Dec 2018. An older patch existed for Rev. Ax.", "evidence": "all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10282", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2013-5223", "vendorProject": "D-Link", "product": "DSL-2760U", "vulnerabilityName": "D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2013-5223", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2013-5223", "models": [ "DSL-2760U (HW E1)" ], "status": "fixed", "fixed_in": "1.12", "as_of": "2014-03-05", "note": "All firmware below 1.12 is affected.", "evidence": "D-Link will release new firmware that corrects this vulnerability", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10002", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-16920", "vendorProject": "D-Link", "product": "Multiple Routers", "vulnerabilityName": "D-Link Multiple Routers Command Injection Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-16920", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-16920", "models": [ "DIR-655 Rev Cx", "DIR-866L Rev Ax", "DIR-652 Rev Bx", "DHP-1565 Rev Ax", "DAP-1533 Rev Ax", "DGL-5500 Rev Ax", "DIR-130 Rev Ax", "DIR-330 Rev Ax", "DIR-615 Rev Ix", "DIR-825 Rev Cx", "DIR-835 Rev Ax", "DIR-855L Rev Ax", "DIR-862 Rev Ax" ], "status": "end_of_life", "as_of": "2019-11-19", "note": "No further development; D-Link recommends retiring them.", "evidence": "these products have reached End of Life(EoL)/End of Support(EoS)", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10124", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-9377", "vendorProject": "D-Link", "product": "DIR-610 Devices", "vulnerabilityName": "D-Link DIR-610 Devices Remote Command Execution", "dateAdded": "2022-03-25", "shortDescription": "D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-9377", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-9377", "models": [ "DIR-610 Rev. Ax" ], "status": "end_of_life", "as_of": "2020-07-09", "note": "End of support in 2014; D-Link says retire and replace.", "evidence": "The DIR-610 Rev. Ax reached its End-of-Support Date in 2014", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10182", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2021-45382", "vendorProject": "D-Link", "product": "Multiple Routers", "vulnerabilityName": "D-Link Multiple Routers Remote Code Execution Vulnerability", "dateAdded": "2022-04-04", "shortDescription": "A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-45382", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2021-45382", "models": [ "DIR-810L", "DIR-820L/LW", "DIR-826L", "DIR-830L", "DIR-836L" ], "status": "end_of_life", "as_of": "2021-12-20", "note": "All hardware revisions; support ended 2017-2018.", "evidence": "all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10264", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2011-4723", "vendorProject": "D-Link", "product": "DIR-300 Router", "vulnerabilityName": "D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability", "dateAdded": "2022-09-08", "shortDescription": "The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.dlink.com/uk/en/support/product/dir-300-wireless-g-router; https://nvd.nist.gov/vuln/detail/CVE-2011-4723", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [] }, { "cveID": "CVE-2018-6530", "vendorProject": "D-Link", "product": "Multiple Routers", "vulnerabilityName": "D-Link Multiple Routers OS Command Injection Vulnerability", "dateAdded": "2022-09-08", "shortDescription": "Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.", "requiredAction": "The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.", "knownRansomwareCampaignUse": "Known", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105; https://nvd.nist.gov/vuln/detail/CVE-2018-6530", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2018-6530", "models": [ "DIR-860L Rev. A", "DIR-865L Rev. A", "DIR-868L Rev. A", "DIR-880L Rev. A" ], "status": "fixed", "fixed_in": "beta builds: DIR-860L 1.11b01, DIR-865L 1.10b01, DIR-868L 1.20b01, DIR-880L 1.08b06", "as_of": "2022-09-07", "note": "The fixes are beta builds; three of the models were later declared end of life.", "evidence": "patched and release new firmware for each of the affected models below", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10102", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-26258", "vendorProject": "D-Link", "product": "DIR-820L", "vulnerabilityName": "D-Link DIR-820L Remote Code Execution Vulnerability", "dateAdded": "2022-09-08", "shortDescription": "D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10295; https://nvd.nist.gov/vuln/detail/CVE-2022-26258", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-26258", "models": [ "DIR-820L (all hardware revisions)" ], "status": "end_of_life", "as_of": "2025-11-21", "note": "End of support 1 Nov 2017; D-Link says retire and replace.", "evidence": "The DIR-820L, all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10295", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-17621", "vendorProject": "D-Link", "product": "DIR-859 Router", "vulnerabilityName": "D-Link DIR-859 Router Command Execution Vulnerability", "dateAdded": "2023-06-29", "shortDescription": "D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.", "requiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-17621", "models": [ "DIR-859 (Ax)" ], "status": "fixed", "fixed_in": "1.07b03 beta", "as_of": "2020-01-28", "note": "Beta firmware; every DIR-859 revision was declared end of life in 2024.", "evidence": "confirmmed and released patches to close this issue", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10146", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2019-20500", "vendorProject": "D-Link", "product": "DWL-2600AP Access Point", "vulnerabilityName": "D-Link DWL-2600AP Access Point Command Injection Vulnerability", "dateAdded": "2023-06-29", "shortDescription": "D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.", "requiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2019-20500", "models": [ "DWL-2600AP Rev A" ], "status": "fixed", "fixed_in": "4.2.0.17", "as_of": "2023-06-23", "note": "Firmware 4.2.0.15 and older affected.", "evidence": "4.2.0.15 and older (lower) v4.2.0.15b001c v4.2.0.17", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10113", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2016-20017", "vendorProject": "D-Link", "product": "DSL-2750B Devices", "vulnerabilityName": "D-Link DSL-2750B Devices Command Injection Vulnerability", "dateAdded": "2024-01-08", "shortDescription": "D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088; https://nvd.nist.gov/vuln/detail/CVE-2016-20017", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2016-20017", "models": [ "DSL-2750B Rev Dx" ], "status": "fixed", "fixed_in": "EU_1.05", "as_of": "2023-10-16", "note": "D-Link still urges owners to retire and replace the device.", "evidence": "Some products have fixes for these older CVEs", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2014-100005", "vendorProject": "D-Link", "product": "DIR-600 Router", "vulnerabilityName": "D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability", "dateAdded": "2024-05-16", "shortDescription": "D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.", "requiredAction": "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283; https://nvd.nist.gov/vuln/detail/CVE-2014-100005", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2014-100005", "models": [ "DIR-600 Rev. Bx" ], "status": "fixed", "fixed_in": "2.17b02", "as_of": "2014-06-30", "note": "The DIR-600 was later declared end of life.", "evidence": "v 2.17b02 Fixed", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10018", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2021-40655", "vendorProject": "D-Link", "product": "DIR-605 Router", "vulnerabilityName": "D-Link DIR-605 Router Information Disclosure Vulnerability", "dateAdded": "2024-05-16", "shortDescription": "D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. ", "requiredAction": "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5; https://nvd.nist.gov/vuln/detail/CVE-2021-40655", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2021-40655", "models": [ "DIR-605 (all hardware revisions)" ], "status": "end_of_life", "as_of": "2026-09-21", "note": "D-Link's notice retires the model; it does not name this CVE.", "evidence": "All Models and all hardware revisions have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10393", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-25280", "vendorProject": "D-Link", "product": "DIR-820 Router", "vulnerabilityName": "D-Link DIR-820 Router OS Command Injection Vulnerability", "dateAdded": "2024-09-30", "shortDescription": "D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.", "requiredAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358 ; https://nvd.nist.gov/vuln/detail/CVE-2023-25280", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-25280", "models": [ "DIR-820L (all hardware revisions)" ], "status": "end_of_life", "as_of": "2025-11-21", "note": "D-Link's notice retires the model; it does not name this CVE.", "evidence": "The DIR-820L, all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10295", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2024-0769", "vendorProject": "D-Link", "product": "DIR-859 Router", "vulnerabilityName": " D-Link DIR-859 Router Path Traversal Vulnerability", "dateAdded": "2025-06-25", "shortDescription": "D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0769", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2024-0769", "models": [ "DIR-859 (all hardware revisions)" ], "status": "end_of_life", "as_of": "2024-07-26", "note": "End of support 10 Dec 2020; D-Link says retire and replace.", "evidence": "The DIR-859, all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10371", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2022-37055", "vendorProject": "D-Link", "product": "Routers", "vulnerabilityName": "D-Link Routers Buffer Overflow Vulnerability", "dateAdded": "2025-12-08", "shortDescription": "D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308 ; https://nvd.nist.gov/vuln/detail/CVE-2022-37055", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2022-37055", "models": [ "GO-RT-AC750 (all hardware revisions)" ], "status": "end_of_life", "as_of": "2025-12-08", "note": "End of support 29 Feb 2020.", "evidence": "All hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2025-29635", "vendorProject": "D-Link", "product": "DIR-823X", "vulnerabilityName": "D-Link DIR-823X Command Injection Vulnerability", "dateAdded": "2026-04-24", "shortDescription": "D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29635", "vendor": "d-link", "page": "https://myipscan.net/routers/d-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2025-29635", "models": [ "DIR-823X (all hardware revisions)" ], "status": "end_of_life", "as_of": "2026-04-23", "note": "End of support 15 Nov 2024; D-Link says retire and replace.", "evidence": "The DIR-823X, all hardware revisions, have reached their End of Life", "source_url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10469", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-8515", "vendorProject": "DrayTek", "product": "Multiple Vigor Routers", "vulnerabilityName": "Multiple DrayTek Vigor Routers Web Management Page Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-8515", "vendor": "draytek", "page": "https://myipscan.net/routers/draytek/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-8515", "models": [ "Vigor300B", "Vigor2960", "Vigor3900" ], "status": "fixed", "fixed_in": "1.5.1", "as_of": "2020-02-10", "note": "Vigor3900 and Vigor300B are now end of life, Vigor2960 end of sale.", "evidence": "Users of affected models should upgrade to 1.5.1 firmware or later", "source_url": "https://www.draytek.com/about/security-advisory/vigor3900-vigor2960-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-15415", "vendorProject": "DrayTek", "product": "Multiple Vigor Routers", "vulnerabilityName": "DrayTek Multiple Vigor Routers OS Command Injection Vulnerability", "dateAdded": "2024-09-30", "shortDescription": "DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472) ; https://nvd.nist.gov/vuln/detail/CVE-2020-15415", "vendor": "draytek", "page": "https://myipscan.net/routers/draytek/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-15415", "models": [ "Vigor300B", "Vigor2960", "Vigor3900" ], "status": "fixed", "fixed_in": "1.5.1.1", "as_of": "2020-06-24", "note": "Advisory titled CVE-2020-14472 / CVE-2020-15415.", "evidence": "Users of affected models should upgrade firmware to version 1.5.1.1 or later", "source_url": "https://www.draytek.com/about/security-advisory/vigor3900-vigor2960-vigor300b-remote-code-injection-execution-vulnerability-(cve-2020-14472)", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2024-12987", "vendorProject": "DrayTek", "product": "Vigor Routers", "vulnerabilityName": "DrayTek Vigor Routers OS Command Injection Vulnerability", "dateAdded": "2025-05-15", "shortDescription": "DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_Vigor2960_V1.5.1.5_01release-note.pdf ; https://fw.draytek.com.tw/Vigor300B/Firmware/v1.5.1.5/DrayTek_Vigor300B_V1.5.1.5_01release-note.pdf ; https://fw.draytek.com.tw/Vigor3900/Firmware/v1.5.1.5/DrayTek_Vigor3900_V1.5.1.5_01release-note.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-12987", "vendor": "draytek", "page": "https://myipscan.net/routers/draytek/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2024-12987", "models": [ "Vigor2960 Series", "Vigor300B" ], "status": "fixed", "fixed_in": "1.5.1.5", "as_of": "2025-05", "note": "No advisory page; the fix is named in the release notes of 1.5.1.5 (release type: critical).", "evidence": "Improve Web GUI Security (CVE-2024-12987).", "source_url": "https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.5/DrayTek_Vigor2960_V1.5.1.5_01release-note.pdf", "source_type": "pdf", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2018-14847", "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik Router OS Directory Traversal Vulnerability", "dateAdded": "2021-12-01", "shortDescription": "MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2018-14847", "vendor": "mikrotik", "page": "https://myipscan.net/routers/mikrotik/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2018-14847", "models": [ "RouterOS" ], "status": "fixed", "fixed_in": "6.40.8 (bugfix), 6.42.1 (current)", "as_of": "2018-07-12", "note": "Affects RouterOS 6.29 to 6.42. MikroTik says upgrade and change passwords.", "evidence": "fixed in 6.40.8", "source_url": "https://blog.mikrotik.com/security/winbox-vulnerability.html", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2018-7445", "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability", "dateAdded": "2022-09-08", "shortDescription": "In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download; https://nvd.nist.gov/vuln/detail/CVE-2018-7445", "vendor": "mikrotik", "page": "https://myipscan.net/routers/mikrotik/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2018-7445", "models": [ "RouterOS" ], "status": "fixed", "fixed_in": "6.41.3 (also 6.40.7 bugfix)", "as_of": "2018-03", "note": "The changelog names the SMB overflow fix but not the CVE number.", "evidence": "smb - fixed buffer overflow vulnerability", "source_url": "https://download.mikrotik.com/routeros/6.41.3/CHANGELOG", "source_type": "text", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2026-67277", "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability", "dateAdded": "2026-09-10", "shortDescription": "MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "vendor": "mikrotik", "page": "https://myipscan.net/routers/mikrotik/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-67277", "models": [ "RouterOS" ], "status": "fixed", "fixed_in": "7.24.2, 7.23.4, 6.49.21", "as_of": "2026-09-03", "note": "Bandwidth-test crash or memory disclosure.", "evidence": "Fixed in 7.24.2, 7.23.4 and 6.49.21.", "source_url": "https://blog.mikrotik.com/supportsec/september-2026-vulnerability/", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2026-86060", "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "dateAdded": "2026-09-10", "shortDescription": "MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://mikrotik.com/supportsec/september-2026-vulnerability ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060", "vendor": "mikrotik", "page": "https://myipscan.net/routers/mikrotik/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-86060", "models": [ "RouterOS" ], "status": "fixed", "fixed_in": "7.24.2, 7.23.4, 6.49.21", "as_of": "2026-09-03", "note": "SSH session gets excess rights.", "evidence": "Fixed in 7.24.2, 7.23.4 and 6.49.21.", "source_url": "https://blog.mikrotik.com/supportsec/september-2026-vulnerability/", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2026-67279", "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability", "dateAdded": "2026-09-25", "shortDescription": "Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://mikrotik.com/supportsec/september-2026-vulnerability/?utm_source=chatgpt.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67279", "vendor": "mikrotik", "page": "https://myipscan.net/routers/mikrotik/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-67279", "models": [ "RouterOS" ], "status": "fixed", "fixed_in": "7.24.2, 7.23.4, 6.49.21", "as_of": "2026-09-03", "note": "Pre-auth SSH command execution; MikroTik says this one was exploited.", "evidence": "This is the issue that was seen being exploited in the wild.", "source_url": "https://blog.mikrotik.com/supportsec/september-2026-vulnerability/", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2016-6277", "vendorProject": "NETGEAR", "product": "Multiple Routers", "vulnerabilityName": "NETGEAR Multiple Routers Remote Code Execution Vulnerability", "dateAdded": "2022-03-07", "shortDescription": "NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2016-6277", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2016-6277", "models": [ "R6250", "R6400", "R6700", "R6900", "R7000", "R7100LG", "R7300DST", "R7900", "R8000", "D6220", "D6400" ], "status": "fixed", "fixed_in": "per-model firmware; versions not listed", "as_of": "2025-10-17", "note": "PSV-2016-0245. D7000 tested not affected.", "evidence": "All products now have production firmware fixes available.", "source_url": "https://kb.netgear.com/000036386/CVE-2016-582384", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2017-6077", "vendorProject": "NETGEAR", "product": "Wireless Router DGN2200", "vulnerabilityName": "NETGEAR DGN2200 Remote Code Execution Vulnerability", "dateAdded": "2022-03-07", "shortDescription": "NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2017-6077", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-6077", "models": [ "DGN2200v1" ], "status": "fixed", "fixed_in": "1.0.0.55", "as_of": "2025-07-07", "note": "DGN2200v3/v4 not vulnerable. NETGEAR also advises changing the default admin password.", "evidence": "NETGEAR has released a firmware fix for this vulnerability, DGN2200v1 firmware version 1.0.0.55.", "source_url": "https://kb.netgear.com/000037343/Security-Advisory-for-Remote-Command-Execution-and-CSRF-Vulnerabilities-on-DGN2200", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2016-10174", "vendorProject": "NETGEAR", "product": "WNR2000v5 Router", "vulnerabilityName": "NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2016-10174", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2016-10174", "models": [ "D6100", "D7000", "D7800", "JNR1010v2", "JNR3300", "JWNR2010v5", "R2000", "R6100", "R6220", "R7500", "R7500v2", "WNDR3700v4", "WNDR3800", "WNDR4300", "WNDR4300v2", "WNDR4500v3", "WNDR4700", "WNR1000v2", "WNR1000v4", "WNR2000v3", "WNR2000v4", "WNR2000v5", "WNR2020", "WNR2050", "WNR2200", "WNR2500", "WNR614", "WNR618" ], "status": "fixed", "fixed_in": "per-model firmware; versions not listed", "as_of": "2025-07-07", "note": "PSV-2016-0255. Remote management is off by default.", "evidence": "NETGEAR has released production firmware updates that fix the remote access and command execution vulnerability", "source_url": "https://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2016-1555", "vendorProject": "NETGEAR", "product": "Wireless Access Point (WAP) Devices", "vulnerabilityName": "NETGEAR Multiple WAP Devices Command Injection Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2016-1555", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2016-1555", "models": [ "WN604", "WNAP210v2", "WNAP320", "WNDAP350", "WNDAP360", "WNDAP660" ], "status": "fixed", "fixed_in": "WN604 3.3.3; others 3.5.5.0", "as_of": "2025-10-17", "note": "WN802Tv2 is listed as affected but has no fixed release in the table.", "evidence": "WNAP320 ProSAFE Wireless-N Access Point v3.5.5.0 or later", "source_url": "https://kb.netgear.com/30480/CVE-2016-1555-Notification", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2017-6334", "vendorProject": "NETGEAR", "product": "DGN2200 Devices", "vulnerabilityName": "NETGEAR DGN2200 Devices OS Command Injection Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands", "requiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2017-6334", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-6334", "models": [ "DGN2200v1" ], "status": "fixed", "fixed_in": "1.0.0.55 (reduces the risk)", "as_of": "2025-07-07", "note": "NETGEAR says the firmware decreases the risk rather than removing it.", "evidence": "significantly decreases the risk of CSRF exploits for DGN2200v1 users", "source_url": "https://kb.netgear.com/000037343/Security-Advisory-for-Remote-Command-Execution-and-CSRF-Vulnerabilities-on-DGN2200", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "kev_status", "cve": "CVE-2017-6334", "models": [ "WGR614v8", "WGT624v4", "WNR834Bv2", "WNDR3300", "WNMR834", "WNR3500" ], "status": "end_of_life", "as_of": "2025-07-07", "note": "Also affected and no longer supported.", "evidence": "also affects the following devices, which are no longer supported", "source_url": "https://kb.netgear.com/000037343/Security-Advisory-for-Remote-Command-Execution-and-CSRF-Vulnerabilities-on-DGN2200", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2017-6862", "vendorProject": "NETGEAR", "product": "Multiple Devices", "vulnerabilityName": "NETGEAR Multiple Devices Buffer Overflow Vulnerability", "dateAdded": "2022-06-08", "shortDescription": "Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2017-6862", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-6862", "models": [ "WNR2000v3", "WNR2000v4", "WNR2000v5", "R2000" ], "status": "fixed", "fixed_in": "per-model firmware; versions not listed", "as_of": "2025-07-07", "note": "PSV-2016-0261. Exploitable from the LAN, or from the internet with remote management on.", "evidence": "firmware updates that fix the unauthenticated remote code execution vulnerability for all affected products", "source_url": "https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2017-5521", "vendorProject": "NETGEAR", "product": "Multiple Devices", "vulnerabilityName": "NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability", "dateAdded": "2022-09-08", "shortDescription": "Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.", "requiredAction": "Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2017-5521", "vendor": "netgear", "page": "https://myipscan.net/routers/netgear/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-5521", "models": [ "R8500", "R8300", "R7000", "R6400", "R7300DST", "R7100LG", "R6300v2", "WNDR3400v3", "WNR3500Lv2", "R6250", "R6700", "R6900", "R8000", "R7900", "WNDR4500v2", "R6200v2", "WNDR3400v2", "D6220", "D6400", "C6300" ], "status": "fixed", "fixed_in": "per-model firmware; versions not listed", "as_of": "2025-07-07", "note": "The CVE ties to this article; the article does not repeat the number.", "evidence": "Firmware fixes are currently available for the following affected devices.", "source_url": "https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "kev_status", "cve": "CVE-2017-5521", "models": [ "R6200", "R6300", "VEGN2610", "AC1450", "WNR1000v3", "WNDR3700v3", "WNDR4000", "WNDR4500", "D6300", "D6300B", "DGN2200Bv4", "DGN2200v4" ], "status": "mitigated", "as_of": "2025-07-07", "note": "No firmware fix: turn on password recovery and keep remote management off.", "evidence": "For the following affected products, NETGEAR recommends using the workaround procedure explained in this article.", "source_url": "https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2018-14558", "vendorProject": "Tenda", "product": "AC7, AC9, and AC10 Routers", "vulnerabilityName": "Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the \"formsetUsbUnload\" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2018-14558", "vendor": "tenda", "page": "https://myipscan.net/routers/tenda/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2018-14558", "models": [ "AC7", "AC9", "AC10" ], "status": "not_stated", "note": "No Tenda bulletin; firmware notes say only that vulnerabilities were fixed.", "source_url": "https://www.tendacn.com/page/securityadvisory", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-10987", "vendorProject": "Tenda", "product": "AC1900 Router AC15 Model", "vulnerabilityName": "Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2020-10987", "vendor": "tenda", "page": "https://myipscan.net/routers/tenda/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-10987", "models": [ "AC15" ], "status": "not_stated", "note": "No Tenda bulletin found.", "source_url": "https://www.tendacn.com/page/securityadvisory", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2021-31755", "vendorProject": "Tenda", "product": "AC11 Router", "vulnerabilityName": "Tenda AC11 Router Stack Buffer Overflow Vulnerability", "dateAdded": "2021-11-03", "shortDescription": "Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-31755", "vendor": "tenda", "page": "https://myipscan.net/routers/tenda/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2021-31755", "models": [ "AC11" ], "status": "not_stated", "note": "No Tenda bulletin found. AC11 V2.0 is on Tenda's end-of-life list.", "source_url": "https://www.tendacn.com/page/securityadvisory", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2015-3035", "vendorProject": "TP-Link", "product": "Multiple Archer Devices", "vulnerabilityName": "TP-Link Multiple Archer Devices Directory Traversal Vulnerability", "dateAdded": "2022-03-25", "shortDescription": "Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2015-3035", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2015-3035", "models": [ "Archer C7 V2" ], "status": "fixed", "fixed_in": "Archer C7_V2_150304", "as_of": "2015-03-04", "note": "Release notes; the same line appears for Archer C5 V1.20 and TL-WDR3600 V1.", "evidence": "Fixed the directory traversal security bug", "source_url": "https://www.tp-link.com/en/support/download/archer-c7/v2/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-1389", "vendorProject": "TP-Link", "product": "Archer AX21", "vulnerabilityName": "TP-Link Archer AX-21 Command Injection Vulnerability", "dateAdded": "2023-05-01", "shortDescription": "TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware; https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-1389", "models": [ "Archer AX21(US) V3" ], "status": "fixed", "fixed_in": "1.1.4 Build 20230219", "as_of": "2023-03-17", "note": "The release notes say only that security issues were fixed; they do not name the CVE.", "evidence": "Archer AX21(US)_V3_1.1.4 Build 20230219", "source_url": "https://www.tp-link.com/us/support/download/archer-ax21/v3/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-33538", "vendorProject": "TP-Link", "product": "Multiple Routers", "vulnerabilityName": "TP-Link Multiple Routers Command Injection Vulnerability", "dateAdded": "2025-06-16", "shortDescription": "TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.tp-link.com/nordic/support/faq/3562/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-33538", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-33538", "models": [ "TL-WR940N V2/V4", "TL-WR841N V8/V10", "TL-WR740N V1/V2" ], "status": "not_stated", "note": "No TP-Link advisory for this CVE; CISA points to TP-Link's end-of-service list.", "source_url": "https://www.tp-link.com/us/support/faq/3562/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2020-24363", "vendorProject": "TP-Link", "product": "TL-WA855RE", "vulnerabilityName": "TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability", "dateAdded": "2025-09-02", "shortDescription": "TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.tp-link.com/us/home-networking/range-extender/tl-wa855re/#overview ; https://www.tp-link.com/us/support/download/tl-wa855re/#FAQs ; https://nvd.nist.gov/vuln/detail/CVE-2020-24363", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2020-24363", "models": [ "TL-WA855RE(US) V5" ], "status": "fixed", "fixed_in": "TL-WA855RE(US)_V5_200731", "as_of": "2020-08-17", "note": "Release notes describe the reset flaw; they do not name the CVE.", "evidence": "Fixed the security issue of logging in to the web UI causes a reset", "source_url": "https://www.tp-link.com/us/support/download/tl-wa855re/v5/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2023-50224", "vendorProject": "TP-Link", "product": "TL-WR841N", "vulnerabilityName": "TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability", "dateAdded": "2025-09-03", "shortDescription": "TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-50224", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2023-50224", "models": [ "TL-WR841N V8-V12", "TL-WR841ND V11" ], "status": "partial", "fixed_in": "TL-WR841N V11 (EU 211209), V12 (EU 230317); TL-WR841ND V11 unpatched", "as_of": "2026-05-12", "note": "TP-Link lists TL-WR841N V8-V12 as partially patched and TL-WR841ND V11 as unpatched, and says almost all affected models are end of service.", "evidence": "Partially patched EU_V11_211209", "source_url": "https://www.tp-link.com/us/support/faq/5058/", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2025-9377", "vendorProject": "TP-Link", "product": "Multiple Routers", "vulnerabilityName": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability", "dateAdded": "2025-09-03", "shortDescription": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.", "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-9377", "vendor": "tp-link", "page": "https://myipscan.net/routers/tp-link/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2025-9377", "models": [ "Archer C7(EU) V2", "TL-WR841N(MS) V9", "TL-WR841ND(MS) V9" ], "status": "fixed", "fixed_in": "241108 builds, e.g. Archer C7(EU)_V2_241108", "as_of": "2024-11-09", "note": "CISA's entry links this page. TP-Link says the products are end of service and recommends replacing them.", "evidence": "The patched firmware download links are as follows:", "source_url": "https://www.tp-link.com/us/support/faq/4308/", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2010-5330", "vendorProject": "Ubiquiti", "product": "AirOS", "vulnerabilityName": "Ubiquiti AirOS Command Injection Vulnerability", "dateAdded": "2022-04-15", "shortDescription": "Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.", "requiredAction": "Apply updates per vendor instructions.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2010-5330", "vendor": "ubiquiti", "page": "https://myipscan.net/routers/ubiquiti/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2010-5330", "models": [ "airOS on 802.11 ISP, AirMax ISP and AirSync devices" ], "status": "fixed", "fixed_in": "v4.0.1 (802.11 ISP), v5.3.5 (AirMax ISP), v5.4.5 (AirSync)", "as_of": "2019-06-11", "note": "From the CVE record; Ubiquiti's original forum post now redirects to a JavaScript-only page.", "evidence": "The fixed version is v4.0.1 for 802.11 ISP products", "source_url": "https://cveawg.mitre.org/api/cve/CVE-2010-5330", "source_type": "advisory", "verified_at": "2026-10-19" } ] }, { "cveID": "CVE-2026-34908", "vendorProject": "Ubiquiti", "product": "UniFi OS", "vulnerabilityName": "Ubiquiti UniFi OS Improper Access Control Vulnerability", "dateAdded": "2026-06-23", "shortDescription": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34908", "vendor": "ubiquiti", "page": "https://myipscan.net/routers/ubiquiti/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-34908", "models": [ "UDM", "UDM-Pro", "UDM-SE", "UDM-Pro-Max", "UDM-Beast", "UDR", "UDR7", "UDR-5G", "UDW", "EFG", "Express 7", "UCG-Ultra", "UCG-Max", "UCG-Fiber", "UCG-Industrial" ], "status": "fixed", "fixed_in": "UniFi OS 5.1.12 (UDM-Beast 5.1.11)", "as_of": "2026-05-22", "note": "From the CVE record filed by HackerOne, which links Ubiquiti's Security Advisory Bulletin 064; the bulletin itself loads only with JavaScript.", "evidence": "exploit an Improper Access Control vulnerability found in UniFi OS devices", "source_url": "https://cveawg.mitre.org/api/cve/CVE-2026-34908", "source_type": "advisory", "verified_at": "2026-10-19" } ] }, { "cveID": "CVE-2026-34909", "vendorProject": "Ubiquiti", "product": "UniFi OS", "vulnerabilityName": "Ubiquiti UniFi OS Path Traversal Vulnerability", "dateAdded": "2026-06-23", "shortDescription": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34909", "vendor": "ubiquiti", "page": "https://myipscan.net/routers/ubiquiti/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-34909", "models": [ "UDM", "UDM-Pro", "UDM-SE", "UDM-Pro-Max", "UDM-Beast", "UDR", "UDR7", "UDR-5G", "UDW", "EFG", "Express", "Express 7", "UCG-Ultra", "UCG-Max", "UCG-Fiber", "UCG-Industrial" ], "status": "fixed", "fixed_in": "UniFi OS 5.1.12 (UDM-Beast 5.1.11, Express 4.0.14)", "as_of": "2026-05-22", "note": "From the CVE record filed by HackerOne, which links Ubiquiti's Security Advisory Bulletin 064.", "evidence": "exploit a Path Traversal vulnerability found in UniFi OS devices", "source_url": "https://cveawg.mitre.org/api/cve/CVE-2026-34909", "source_type": "advisory", "verified_at": "2026-10-19" } ] }, { "cveID": "CVE-2026-34910", "vendorProject": "Ubiquiti", "product": "UniFi OS", "vulnerabilityName": "Ubiquiti UniFi OS Improper Input Validation Vulnerability", "dateAdded": "2026-06-23", "shortDescription": "Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34910", "vendor": "ubiquiti", "page": "https://myipscan.net/routers/ubiquiti/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2026-34910", "models": [ "UDM", "UDM-Pro", "UDM-SE", "UDM-Pro-Max", "UDM-Beast", "UDR", "UDR7", "UDR-5G", "UDW", "EFG", "Express 7", "UCG-Ultra", "UCG-Max", "UCG-Fiber", "UCG-Industrial" ], "status": "fixed", "fixed_in": "UniFi OS 5.1.12 (UDM-Beast 5.1.11)", "as_of": "2026-05-22", "note": "From the CVE record filed by HackerOne, which links Ubiquiti's Security Advisory Bulletin 064.", "evidence": "exploit an Improper Input Validation vulnerability found in UniFi OS devices", "source_url": "https://cveawg.mitre.org/api/cve/CVE-2026-34910", "source_type": "advisory", "verified_at": "2026-10-19" } ] }, { "cveID": "CVE-2017-18368", "vendorProject": "Zyxel", "product": "P660HN-T1A Routers", "vulnerabilityName": "Zyxel P660HN-T1A Routers Command Injection Vulnerability", "dateAdded": "2023-08-07", "shortDescription": "Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368", "vendor": "zyxel", "page": "https://myipscan.net/routers/zyxel/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-18368", "models": [ "P660HN-T1A" ], "status": "end_of_life", "as_of": "2023-08-08", "note": "Firmware 3.40(ULM.0)b3. Zyxel says the customized build was patched in 2017; the model is past end of life: replace it.", "evidence": "the P660HN-T1A reached end-of-life several years ago", "source_url": "https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-command-injection-vulnerability-p660hn-t1a-dsl-cpe", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2017-6884", "vendorProject": "Zyxel", "product": "EMG2926 Routers", "vulnerabilityName": "Zyxel EMG2926 Routers Command Injection Vulnerability", "dateAdded": "2023-09-18", "shortDescription": "Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "knownRansomwareCampaignUse": "Known", "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp; https://nvd.nist.gov/vuln/detail/CVE-2017-6884", "vendor": "zyxel", "page": "https://myipscan.net/routers/zyxel/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2017-6884", "models": [ "EMG2926-Q10A" ], "status": "end_of_life", "as_of": "2023-09-19", "note": "NSLOOKUP command injection in V1.00(AAQT.4)b8. No fixed version named; the model is end-of-support: replace it.", "evidence": "The EMG2926-Q10A is a legacy product that has reached end-of-support.", "source_url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2024-40890", "vendorProject": "Zyxel", "product": "DSL CPE Devices", "vulnerabilityName": "Zyxel DSL CPE OS Command Injection Vulnerability", "dateAdded": "2025-02-11", "shortDescription": "Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.", "requiredAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40890", "vendor": "zyxel", "page": "https://myipscan.net/routers/zyxel/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2024-40890", "models": [ "VMG1312-B10A", "VMG1312-B10B", "VMG1312-B10E", "VMG3312-B10A", "VMG3313-B10A", "VMG3926-B10B", "VMG4325-B10A", "VMG4380-B10A", "VMG8324-B10A", "VMG8924-B10A", "SBG3300", "SBG3500" ], "status": "end_of_life", "as_of": "2025-02-04", "note": "No patch. Zyxel advises replacement; WAN access is off by default.", "evidence": "are legacy products that have reached EOL status for several years.", "source_url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025", "source_type": "advisory", "verified_at": "2026-10-18" } ] }, { "cveID": "CVE-2024-40891", "vendorProject": "Zyxel", "product": "DSL CPE Devices", "vulnerabilityName": "Zyxel DSL CPE OS Command Injection Vulnerability", "dateAdded": "2025-02-11", "shortDescription": "Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.", "requiredAction": "The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025 ; https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40891", "vendor": "zyxel", "page": "https://myipscan.net/routers/zyxel/", "vendor_statements": [ { "kind": "kev_status", "cve": "CVE-2024-40891", "models": [ "VMG1312-B10A", "VMG1312-B10B", "VMG1312-B10E", "VMG3312-B10A", "VMG3313-B10A", "VMG3926-B10B", "VMG4325-B10A", "VMG4380-B10A", "VMG8324-B10A", "VMG8924-B10A", "SBG3300", "SBG3500" ], "status": "end_of_life", "as_of": "2025-02-04", "note": "Telnet command injection, same advisory and models. No fix: replace the device.", "evidence": "Zyxel advises customers to replace these legacy products with newer-generation equipment", "source_url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025", "source_type": "advisory", "verified_at": "2026-10-18" } ] } ] } }