Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Nov 13, 2025An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.CVE-2025-60676 · Other software · Dlink · reported by MITREMedium 6.5
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module.CVE-2025-60674 · Other software · Dlink · reported by MITREMedium 6.8
A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling module. The vulnerability occurs when the "Serial Number" field from a USB device is read via sscanf into a 64-byte stack buffer, while fgets reads up to 127 bytes, causing a stack overflow. An attacker with physical access or control over a USB device can exploit this vulnerability to potentially execute arbitrary code on the device.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.CVE-2025-60673 · Other software · Dlink · reported by MITREMedium 6.5
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDMZSettings' functionality, where the 'IPAddress' parameter in prog.cgi is stored in NVRAM and later used by librcm.so to construct iptables commands executed via twsystem(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin.CVE-2025-60672 · Other software · Dlink · reported by MITREMedium 6.5
An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetDynamicDNSSettings' functionality, where the 'ServerAddress' and 'Hostname' parameters in prog.cgi are stored in NVRAM and later used by rc to construct system commands executed via twsystem(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function.CVE-2023-27720 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 1.30B08 was discovered to contain a stack overflow in the sub_48d630 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function.CVE-2023-24800 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function.CVE-2023-24799 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function.CVE-2023-24798 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.CVE-2022-44801 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.CVE-2022-44202 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.CVE-2022-43184 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function.CVE-2021-44882 · Other software · Dlink · reported by MITRECritical 9.8
D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Feb 3, 2022D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the sCVE-2021-44880 · Other software · Dlink · reported by MITRECritical 9.8
D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the system function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Apr 2, 2021An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices.CVE-2021-30072 · Other software · Dlink · reported by MITRECritical 9.8
An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused, there is a stack-based buffer overflow that does not require authentication.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comdlink.com
Feb 25, 2019An issue was discovered on D-Link DIR-878 1.12B01 devices.CVE-2019-9125 · Network & remote access · D-link · reported by MITRECritical 9.8
An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2019An issue was discovered on D-Link DIR-878 1.12B01 devices.CVE-2019-9124 · Network & remote access · D-link · reported by MITRECritical 9.8
An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8319 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8318 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8317 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8316 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8315 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8314 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8313 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2019An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1.CVE-2019-8312 · Other software · Dlink · reported by MITREHigh 8.8
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
- Product
- Dir-878 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.