VendorsD-Linkdir-818lw_firmwareall versions
Vulnerabilities

D-Link DIR-818LW Firmware

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

7CVEs
CVE-2018-20114
On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530.
Published 2019-01-02 · Modified
10.0EPSS 0.067
CVE-2019-13481
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
Published 2019-07-10 · Modified
9.0EPSS 0.082
CVE-2019-13482
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.
Published 2019-07-10 · Modified
9.0EPSS 0.081
CVE-2019-12786
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key.
Published 2019-06-10 · Modified
8.8EPSS 0.029
CVE-2019-12787
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.
Published 2019-06-10 · Modified
8.8EPSS 0.029
CVE-2025-7553
D-Link DIR-818LW System Time Page os command injection
Published 2025-07-13 · Analyzed
7.2EPSS 0.038
CVE-2025-9003
D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scripting
Published 2025-08-15 · Analyzed
5.4EPSS 0.006