CVE-2018-18008: D-Link Dir-140l Firmware

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.

Affected products

• D-Link Dir-140l Firmware: version 1.00 only; version 1.01ru only; version 1.02 only
• D-Link Dir-640l Firmware: version 1.00 only; version 1.01ru only; version 1.02 only
• D-Link DSL-2770l Firmware: version me_1.01 only; version me_1.02 only; version me_1.06 only
• D-Link Dwr-116 Firmware: version 1.03 only; version 1.05 only; version 2.01 only; version 2.02 only
• D-Link Dwr-512 Firmware: version 1.03 only; version 1.05 only; version 2.01 only; version 2.02 only
• D-Link Dwr-555 Firmware: version 1.03 only; version 1.05 only; version 2.01 only; version 2.02 only
• D-Link Dwr-921 Firmware: version 1.03 only; version 1.05 only; version 2.01 only; version 2.02 only

Published 2018-12-21. Last modified 2026-06-17.