D-Link Multiple Routers OS Command Injection Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 6, 2018 · Catalog

   Detected

   OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service pa

2. Sep 8, 2022 · CISA KEV

   Known exploited

   The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

3. Sep 29, 2022 · CISA KEV

   Remediation due

   The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

4. Jun 16, 2026 · Catalog

   Updated

   OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service pa

Affected

• cpe dlink/dir-860l firmwareversion unspecified
• cpe dlink/dir-865l firmwareversion unspecified
• cpe dlink/dir-868l firmwareversion unspecified
• cpe dlink/dir-880l firmwareversion unspecified
• vendor D-Link Multiple Routersversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2018-6530

  Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

  cisa.gov
• CVE.orgVulnerability recordCVE-2018-6530

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2018-6530

  30-day exploitation probability 96.7%

  first.org
• NIST NVDVulnerability recordCVE-2018-6530

  OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-8

  nvd.nist.gov

References

• Exploit · github.com
• CISA note · nvd.nist.gov
• CISA note · supportannouncement.us.dlink.com
• US Government Resource · cisa.gov