HackerFeeds
All CVEs

CVE-2018-6530

CRITICAL9.8
CISA KEV

Published 2018-03-06 · Updated 2026-06-17 · Source cve@mitre.org

Summary

CVE-2018-6530 is a critical-severity (CVSS 9.8) vulnerability in D-Link Multiple Routers. CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 29, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. D-Link has 26 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 26 known-exploited D-Link vulnerabilities →

Description

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: D-Link — Multiple Routers

Name: D-Link Multiple Routers OS Command Injection Vulnerability

Date added: 2022-09-08 · Due: 2022-09-29

USED IN RANSOMWARE

Required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

References

View on NVD