D-Link Dir-815 Firmware vulnerabilities

15 CVEs affecting D-Link Dir-815 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-25115, published 2025-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-51123, published 2024-01-10. Critical severity, CVSS 9.8. EPSS: 24.4% chance of exploitation in the next 30 days. An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgi_main function of the cgibin…
CVE-2024-22651, published 2024-01-24. Critical severity, CVSS 9.8. EPSS: 20.2% chance of exploitation in the next 30 days. There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
CVE-2024-0717, published 2024-01-19. Medium severity, CVSS 5.3. EPSS: 18.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820,…
CVE-2018-25115, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days. Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows…
CVE-2014-8888, published 2018-04-12. Critical severity, CVSS 9.8. EPSS: 5.3% chance of exploitation in the next 30 days. The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors related to an "HTTP command injection…
CVE-2015-0150, published 2018-04-12. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVE-2015-0152, published 2018-04-12. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrative password.
CVE-2018-10106, published 2018-04-16. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure in /htdocs/web/getcfg.php, as demonstrated by a…
CVE-2015-0153, published 2018-04-12. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key.
CVE-2023-37758, published 2023-07-18. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi.

Latest

CVE-2025-6328, published 2025-06-20. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-815 1.01. It has been declared as critical. This vulnerability affects the function sub_403794 of the file hedwig.cgi. The manipulation leads to stack-based…
CVE-2020-25786, published 2020-09-19. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by…
CVE-2018-10108, published 2018-04-16. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php.
CVE-2018-10107, published 2018-04-16. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php.