D-Link Dir-850l Firmware vulnerabilities

27 CVEs affecting D-Link Dir-850l Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-49004, published 2023-12-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-6563, published 2018-07-13. Critical severity, CVSS 9.8. EPSS: 79.7% chance of exploitation in the next 30 days. Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action,…
CVE-2021-46378, published 2022-03-04. High severity, CVSS 7.5. EPSS: 31.9% chance of exploitation in the next 30 days. DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.
CVE-2018-9032, published 2018-03-27. Critical severity, CVSS 9.8. EPSS: 27.7% chance of exploitation in the next 30 days. An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2.06) devices potentially allows attackers…
CVE-2021-46379, published 2022-03-04. Medium severity, CVSS 6.1. EPSS: 15.8% chance of exploitation in the next 30 days. DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.
CVE-2017-3193, published 2017-12-16. High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days. Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administration interface HNAP service.
CVE-2017-14429, published 2017-09-13. Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days. The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root…
CVE-2019-7642, published 2019-03-25. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include…
CVE-2018-20674, published 2019-01-09. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow…
CVE-2017-14421, published 2017-09-13. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon device reset, which allows remote…
CVE-2023-49004, published 2023-12-19. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter.

Latest

CVE-2018-20675, published 2019-01-09. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow…
CVE-2017-14430, published 2017-09-13. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allow remote attackers to cause a denial of service (daemon crash) via…