Actively exploited in the wild
D-Link Multiple Routers Remote Code Execution Vulnerability
D-Link - Multiple Routers · Listed in the CISA KEV since 2022-04-04. This indicates confirmed attacks in production environments.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2021-45382
CriticalCVSS 9.8KEVSummary
A Remote Command Execution (RCE) vulnerability exists in D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers (all hardware revisions) via the DDNS function in the ncc2 binary file. All listed models have reached End of Life (EOL)/End of Service Life (EOS), so the issue will not be patched.
Risk Assessment
A network-accessible attacker can remotely execute arbitrary code on the device, taking full control of it. Since the vendor will not release a fix, the risk remains permanent for organizations using these routers.
Recommendation
Immediately replace affected routers with newer vendor-supported models, as no security patch will be released. Until replacement, isolate the devices in a separate network segment and restrict access to the DDNS interface.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.