D-Link Dsr-250 Firmware vulnerabilities

9 CVEs affecting D-Link Dsr-250 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-57376, published 2025-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-18568, published 2021-02-02. Critical severity, CVSS 9.8. EPSS: 14.6% chance of exploitation in the next 30 days. The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execution.
CVE-2013-5945, published 2020-02-11. Critical severity, CVSS 9.8. EPSS: 9.8% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N,…
CVE-2013-5946, published 2013-12-19. High severity, CVSS 10.0. EPSS: 6.5% chance of exploitation in the next 30 days. The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500,…
CVE-2024-57376, published 2025-01-28. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticated users to execute remote code execution.
CVE-2020-25759, published 2020-12-15. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to…
CVE-2020-25757, published 2020-12-15. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with…
CVE-2013-7004, published 2013-12-19. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware…
CVE-2020-25758, published 2020-12-15. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into…
CVE-2013-7005, published 2013-12-19. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware…