D-Link Dap-1520 Firmware vulnerabilities

5 CVEs affecting D-Link Dap-1520 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-4356, published 2025-05-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-15892, published 2020-07-22. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi…
CVE-2025-4356, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been declared as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component…
CVE-2025-4355, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been classified as critical. This affects the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based…
CVE-2025-4354, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical. Affected by this issue is the function check_dws_cookie of the file /storage. The manipulation leads to…
CVE-2024-36831, published 2024-12-17. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attackers to cause a Denial of Service (DoS) via a crafted HTTP…