D-Link Dir-816 a2 Firmware vulnerabilities

13 CVEs affecting D-Link Dir-816 a2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-44835, published 2025-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-0921, published 2024-01-26. Critical severity, CVSS 9.8. EPSS: 37.6% chance of exploitation in the next 30 days. A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the…
CVE-2023-43240, published 2023-09-21. Critical severity, CVSS 9.8. EPSS: 13.3% chance of exploitation in the next 30 days. D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
CVE-2023-43239, published 2023-09-21. Critical severity, CVSS 9.8. EPSS: 13.3% chance of exploitation in the next 30 days. D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.
CVE-2023-43237, published 2023-09-21. Critical severity, CVSS 9.8. EPSS: 13.3% chance of exploitation in the next 30 days. D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
CVE-2018-17064, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 7.4% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could…
CVE-2018-17066, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This…
CVE-2018-17063, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This…
CVE-2018-17068, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead…
CVE-2018-17067, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address.
CVE-2018-17065, published 2018-09-15. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite…

Latest

CVE-2025-44835, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbitrary commands via shell.
CVE-2023-43238, published 2023-09-21. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
CVE-2023-43236, published 2023-09-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.