D-Link DIR-300 Firmware vulnerabilities

8 CVEs affecting D-Link DIR-300 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-10069, published 2025-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-4723: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability, published 2011-12-20. Medium severity, CVSS 5.7. Actively exploited: in CISA KEV since 2022-09-08. EPSS: 3.1% chance of exploitation in the next 30 days. The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
CVE-2013-7471, published 2019-06-11. Critical severity, CVSS 9.8. EPSS: 24% chance of exploitation in the next 30 days. An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command…
CVE-2024-0717, published 2024-01-19. Medium severity, CVSS 5.3. EPSS: 18.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820,…
CVE-2013-10048, published 2025-08-01. Critical severity, CVSS 9.8. EPSS: 17.1% chance of exploitation in the next 30 days. An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the…
CVE-2013-10069, published 2025-08-05. Critical severity, CVSS 9.8. EPSS: 16.7% chance of exploitation in the next 30 days. The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which…
CVE-2013-10050, published 2025-08-01. High severity, CVSS 8.8. EPSS: 13.6% chance of exploitation in the next 30 days. An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface…
CVE-2023-31814, published 2023-05-23. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.
CVE-2024-41616, published 2024-08-06. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.