D-Link Dir-818lw Firmware vulnerabilities

7 CVEs affecting D-Link Dir-818lw Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9003, published 2025-08-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13481, published 2019-07-10. High severity, CVSS 8.8. EPSS: 8.2% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to…
CVE-2019-13482, published 2019-07-10. High severity, CVSS 8.8. EPSS: 8.1% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to…
CVE-2018-20114, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days. On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the…
CVE-2025-7553, published 2025-07-14. High severity, CVSS 7.2. EPSS: 3.9% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server…
CVE-2019-12787, published 2019-06-10. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.
CVE-2019-12786, published 2019-06-10. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key.
CVE-2025-9003, published 2025-08-15. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the…