D-Link Dir-865l Firmware vulnerabilities

16 CVEs affecting D-Link Dir-865l Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-25786, published 2020-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-6530: D-Link Multiple Routers OS Command Injection Vulnerability, published 2018-03-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-09-08. EPSS: 96.7% chance of exploitation in the next 30 days. OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous…
CVE-2019-17621: D-Link DIR-859 Router Command Execution Vulnerability, published 2019-12-30. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-06-29. EPSS: 89.6% chance of exploitation in the next 30 days. The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted…
CVE-2020-13782, published 2020-06-03. High severity, CVSS 8.8. EPSS: 27.1% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
CVE-2019-20213, published 2020-01-02. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
CVE-2013-4857, published 2019-10-25. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. D-Link DIR-865L has PHP File Inclusion in the router xml file.
CVE-2018-6529, published 2018-03-06. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L…
CVE-2018-6528, published 2018-03-06. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and…
CVE-2018-6527, published 2018-03-06. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and…
CVE-2013-4855, published 2019-10-25. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.
CVE-2020-13784, published 2020-06-03. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.

Latest

CVE-2020-25786, published 2020-09-19. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by…
CVE-2020-13787, published 2020-06-03. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information.
CVE-2020-13786, published 2020-06-03. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.
CVE-2020-13785, published 2020-06-03. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
CVE-2020-13783, published 2020-06-03. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.