CVE-2018-17440: D-Link Central Wifimanager

Critical severity, CVSS 9.8. EPSS: 38.5% chance of exploitation in the next 30 days.

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.

Affected products

• D-Link Central Wifimanager: from 1.00, before 1.03 (fixed in 1.03)

Published 2018-10-08. Last modified 2026-06-17.