Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2025-51457] D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within t…

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94036] A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. Th…

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90880] A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function s…

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad alta de inyección de comandos en router D-Link DIR-895L A1_102b07

Se identificó una vulnerabilidad de inyección de comandos (CVSS 8.3) en el componente udhcpcd del router D-Link DIR-895L modelo A1_102b07, explotable remotamente a través de la manipulación del parámetro Hostname. El exploit público ya está disponible, aumentando el riesgo de compromiso de equipos de red corporativos y PYMES en LATAM que utilizan este modelo para conectividad alta.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad alta en D-Link DIR-605 B1v202WWB03: desbordamiento de búfer en L2TP

D-Link DIR-605 B1v202WWB03 presenta una vulnerabilidad de off-by-one en el analizador L2TP Control Message Parser que permite manipulación remota del parámetro peer_hostname. Afecta principalmente a routers utilizados como puntos de acceso VPN en PyMEs y oficinas remotas en LATAM. El acceso requiere conocimiento técnico avanzado, pero el impacto potencial incluye ejecución remota de código en la red corporativa.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

Vulnerabilidad alta en D-Link DSM-G600 1.01 permite escritura fuera de límites

Se ha identificado una debilidad en el manejador multiparte del archivo /load_file.cgi en dispositivos D-Link DSM-G600 versión 1.01, que permite escritura fuera de límites (out-of-bounds write) explotable remotamente. Con CVSS 8.8, esta vulnerabilidad afecta directamente a empresas en LATAM que utilizan estos dispositivos en infraestructuras de almacenamiento NAS, permitiendo a atacantes comprometer sistemas sin autenticación. El exploit está disponible públicamente, elevando significativamente el riesgo de explotación inmediata.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82595] A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function s…

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-70458] rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corr…

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent hea…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16447] A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16332] A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /…

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16329] A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16330] A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function …

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16331] A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function…

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16327] A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing o…

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-15270] A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability …

A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has bee…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

29/06/2026

[CVE-2026-13545] A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of t…

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

13/06/2026

[CVE-2026-12174] A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the functi…

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad ⚠ KEV

24/04/2026

Vulnerabilidad crítica en D-Link DIR-823X bajo explotación activa

CISA confirmó explotación activa de CVE-2025-29635 en routers D-Link DIR-823X, dispositivos ampliamente desplegados en pequeñas y medianas empresas de LATAM para conectividad de sucursales. Aunque no hay evidencia de uso en campañas de ransomware conocidas, la explotación en la naturaleza representa riesgo inmediato para acceso no autorizado a redes corporativas.

d-linkexplotación activavulnerabilidad CISA KEV