D-Link Dir-655 Firmware vulnerabilities

6 CVEs affecting D-Link Dir-655 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-6158, published 2025-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16920: D-Link Multiple Routers Command Injection Vulnerability, published 2019-09-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device…
CVE-2019-13561, published 2019-07-11. Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days. D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter.
CVE-2019-13560, published 2019-07-11. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter.
CVE-2019-13562, published 2019-07-11. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the…
CVE-2025-6158, published 2025-06-17. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. The manipulation leads to stack-based…
CVE-2019-13563, published 2019-07-11. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.