D-Link Multiple Routers OS Command Injection Vulnerability

CheckOps priority index

9.8/10 Patch within 24 h

Severity9.8

Probability9.7

Exploitation5/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 96.7% higher than 99.9% of CVEs

CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:

Exploited for 1,517 days 08 Sept 2022

CISA due date 29 Sept 2022 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 5 / 5

KEV catalog (CISA)08 Sept 2022
Exploited in EUVD (ENISA)08 Sept 2022
Used by ransomwareyes
EPSS above 10 %96.7%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

Affected products

Multiple Routers

Weaknesses (CWE)

CWE-78

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

06 Mar 2018
Published
08 Sept 2022
Exploitation reported (ENISA)
08 Sept 2022
Added to the KEV catalog
29 Sept 2022
CISA remediation due date
26 Sept 2026
EPSS peak: 96.7%

References

Other exploited vulnerabilities from the same vendor

CVE-2025-29635D-Link DIR-823X Command Injection Vulnerability
7.3 · Background exploitation
CVE-2022-37055D-Link Routers Buffer Overflow Vulnerability
8.0 · Background exploitation
CVE-2022-40799D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
6.3 · Background exploitation
CVE-2020-25079D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
6.9 · Background exploitation
CVE-2020-25078D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
8.3 · Background exploitation
CVE-2024-0769D-Link DIR-859 Router Path Traversal Vulnerability
7.0 · Background exploitation