D-Link vulnerabilities
- D-Link has 850 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #16 of 420 vendors on this site by that count.
- Of the 850 with a CVSS score, 564 (66.4%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 26 vulnerabilities attributed to D-Link are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2025-29635, was added on 24 Apr 2026.
- 2 of them (7.7%) are marked as known to be used in ransomware campaigns.
- For the 26 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 926 days.
Records are attributed to D-Link from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 4 |
| 2018 | 2 |
| 2019 | 4 |
| 2020 | 14 |
| 2021 | 26 |
| 2022 | 9 |
| 2023 | 138 |
| 2024 | 397 |
| 2025 | 229 |
| 2026 | 221 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 221 | 59 | 84 | 64.7% | 0% |
| 2025 | 229 | 21 | 107 | 55.9% | 0% |
| 2024 | 397 | 37 | 254 | 73.3% | 0% |
| 2023 | 138 | 7 | 43 | 64.9% | 44.2% |
| 2022 | 9 | 5 | 4 | 100% | 0% |
| 2021 | 26 | 2 | 16 | 85.7% | 19.2% |
| 2020 | 14 | 0 | 14 | 100% | 0% |
| 2019 | 4 | 3 | 0 | 100% | 25% |
| 2018 | 2 | 1 | 0 | 100% | 50% |
| 2017 | 4 | 0 | 1 | 100% | 75% |
| Before 2017 | 4 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2025-29635 | DIR-823X | D-Link DIR-823X Command Injection Vulnerability | 2026-04-24 | Unknown |
| CVE-2022-37055 | Routers | D-Link Routers Buffer Overflow Vulnerability | 2025-12-08 | Unknown |
| CVE-2020-25078 | DCS-2530L and DCS-2670L Devices | D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability | 2025-08-05 | Unknown |
| CVE-2020-25079 | DCS-2530L and DCS-2670L Devices | D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability | 2025-08-05 | Unknown |
| CVE-2022-40799 | DNR-322L | D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | 2025-08-05 | Unknown |
| CVE-2024-0769 | DIR-859 Router | D-Link DIR-859 Router Path Traversal Vulnerability | 2025-06-25 | Unknown |
| CVE-2023-25280 | DIR-820 Router | D-Link DIR-820 Router OS Command Injection Vulnerability | 2024-09-30 | Unknown |
| CVE-2014-100005 | DIR-600 Router | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | 2024-05-16 | Unknown |
| CVE-2021-40655 | DIR-605 Router | D-Link DIR-605 Router Information Disclosure Vulnerability | 2024-05-16 | Unknown |
| CVE-2024-3272 | Multiple NAS Devices | D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | 2024-04-11 | Unknown |
| CVE-2024-3273 | Multiple NAS Devices | D-Link Multiple NAS Devices Command Injection Vulnerability | 2024-04-11 | Unknown |
| CVE-2016-20017 | DSL-2750B Devices | D-Link DSL-2750B Devices Command Injection Vulnerability | 2024-01-08 | Unknown |
| CVE-2019-17621 | DIR-859 Router | D-Link DIR-859 Router Command Execution Vulnerability | 2023-06-29 | Unknown |
| CVE-2019-20500 | DWL-2600AP Access Point | D-Link DWL-2600AP Access Point Command Injection Vulnerability | 2023-06-29 | Unknown |
| CVE-2011-4723 | DIR-300 Router | D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability | 2022-09-08 | Unknown |
| CVE-2018-6530 | Multiple Routers | D-Link Multiple Routers OS Command Injection Vulnerability | 2022-09-08 | Known |
| CVE-2022-26258 | DIR-820L | D-Link DIR-820L Remote Code Execution Vulnerability | 2022-09-08 | Unknown |
| CVE-2019-16057 | DNS-320 Storage Device | D-Link DNS-320 Remote Code Execution Vulnerability | 2022-04-15 | Known |
| CVE-2021-45382 | Multiple Routers | D-Link Multiple Routers Remote Code Execution Vulnerability | 2022-04-04 | Unknown |
| CVE-2013-5223 | DSL-2760U | D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability | 2022-03-25 | Unknown |
| CVE-2016-11021 | DCS-930L Devices | D-Link DCS-930L Devices OS Command Injection Vulnerability | 2022-03-25 | Unknown |
| CVE-2019-16920 | Multiple Routers | D-Link Multiple Routers Command Injection Vulnerability | 2022-03-25 | Unknown |
| CVE-2020-9377 | DIR-610 Devices | D-Link DIR-610 Devices Remote Command Execution | 2022-03-25 | Unknown |
| CVE-2015-2051 | DIR-645 Router | D-Link DIR-645 Router Remote Code Execution Vulnerability | 2022-02-10 | Unknown |
| CVE-2020-25506 | DNS-320 Device | D-Link DNS-320 Device Command Injection Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-29557 | DIR-825 R1 Devices | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring D-Link records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2019-16920 | 100% | 100% | Critical | Yes |
| CVE-2024-3273 | 100% | 100% | High | Yes |
| CVE-2020-25506 | 100% | 100% | Critical | Yes |
| CVE-2024-3272 | 98.1% | 99.9% | Critical | Yes |
| CVE-2023-25280 | 97.9% | 99.9% | Critical | Yes |
| CVE-2021-45382 | 97.8% | 99.9% | Critical | Yes |
| CVE-2024-10914 | 97.5% | 99.9% | Critical | No |
| CVE-2020-25078 | 97.5% | 99.9% | High | Yes |
| CVE-2015-2051 | 97.1% | 99.9% | High | Yes |
| CVE-2019-20500 | 96.7% | 99.9% | High | Yes |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.