D-Link DIR-610 Firmware vulnerabilities

3 CVEs affecting D-Link DIR-610 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-25115, published 2025-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-9377: D-Link DIR-610 Devices Remote Command Execution, published 2020-07-09. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 21.3% chance of exploitation in the next 30 days. D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-9376, published 2020-07-09. High severity, CVSS 7.5. EPSS: 16.6% chance of exploitation in the next 30 days. D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the…
CVE-2018-25115, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days. Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows…