D-Link DIR-820L Firmware vulnerabilities

15 CVEs affecting D-Link DIR-820L Firmware, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-52079, published 2025-10-21.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-25280: D-Link DIR-820 Router OS Command Injection Vulnerability, published 2023-03-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-09-30. EPSS: 97.9% chance of exploitation in the next 30 days. OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
• CVE-2021-45382: D-Link Multiple Routers Remote Code Execution Vulnerability, published 2022-02-17. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 97.8% chance of exploitation in the next 30 days. A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file.…
• CVE-2022-26258: D-Link DIR-820L Remote Code Execution Vulnerability, published 2022-03-28. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-09-08. EPSS: 91.6% chance of exploitation in the next 30 days. D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
• CVE-2015-1187: D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability, published 2017-09-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 82.9% chance of exploitation in the next 30 days. The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
• CVE-2023-25279, published 2023-03-13. Critical severity, CVSS 9.8. EPSS: 31% chance of exploitation in the next 30 days. OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
• CVE-2022-34973, published 2022-08-03. High severity, CVSS 7.5. EPSS: 15.1% chance of exploitation in the next 30 days. D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.
• CVE-2024-51186, published 2024-11-11. High severity, CVSS 8.0. EPSS: 2.1% chance of exploitation in the next 30 days. D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions.
• CVE-2023-44807, published 2023-10-06. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.
• CVE-2023-25283, published 2023-03-13. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp.
• CVE-2023-44808, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.

Latest

• CVE-2025-52079, published 2025-10-21. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.
• CVE-2024-48150, published 2024-10-14. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.
• CVE-2023-44809, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.
• CVE-2023-25281, published 2023-03-16. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage parameter to ping.ccp.
• CVE-2023-25282, published 2023-03-15. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A heap overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the config.log_to_syslog and log_opt_dropPackets parameters to mydlink_api.ccp.