D-Link · Multiple Routers
CVE-2021-45382
D-Link Multiple Routers Remote Code Execution Vulnerability
What it is
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
CISA: A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
What to do
The impacted product is end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: April 25, 2022
More exploited flaws from D-Link
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 8, 2022 | OS Command Injection | Multiple Routers | Critical 9.8 | 97% |
| Mar 25, 2022 | Command Injection | Multiple Routers | Critical 9.8 | >99.9% |
| Apr 24, 2026 | Command Injection | DIR-823X | High 7.2 | 88% |
| Dec 8, 2025 | Buffer Overflow | Routers | Critical 9.8 | 56% |
| Aug 5, 2025 | Unspecified | DCS-2530L and DCS-2670L Devices | High 7.5 | 98% |
| Aug 5, 2025 | DCS-2530L and DCS-2670L Command Injection | DCS-2530L and DCS-2670L Devices | High 8.8 | 54% |
| Aug 5, 2025 | Download of Code Without Integrity Check | DNR-322L | High 8.8 | 34% |
| Jun 25, 2025 | D-Link DIR-859 Router Path Traversal | DIR-859 Router | Medium 5.3 | 83% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.