CVE-2021-28144: D-Link Dir-3060 Firmware

High severity, CVSS 8.8. EPSS: 6% chance of exploitation in the next 30 days.

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.

Affected products

• D-Link Dir-3060 Firmware: up to and including 1.11b04

Published 2021-03-11. Last modified 2026-06-17.