Critical 9.8Known exploited (CISA KEV)Published Mar 6, 2018

CVE-2018-6530OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous version…

Updated under an hour ago (2026-10-19 08:40 UTC)

Does this affect you?

It affects dlink dir-860l_firmware and 3 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Sep 8, 2022; federal agencies had to remediate by Sep 29, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for dlink dir-860l_firmware

Exploited in the last 30 days

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV Sep 8, 2022; federal remediation due Sep 29, 2022; known ransomware useThe vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
EPSS (exploitation in the next 30 days): 96.68% (percentile 100)
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

dlink dir-860l_firmware dlink:dir-860l_firmware	through 1.10b04	NVD
dlink dir-865l_firmware dlink:dir-865l_firmware	through 1.08b01	NVD
dlink dir-868l_firmware dlink:dir-868l_firmware	through 1.12b04	NVD
dlink dir-880l_firmware dlink:dir-880l_firmware	through 1.08b04	NVD

References

https://github.com/TheBeeMan/Pwning-multiple-dlink-router-via-SOAP-protox-refsource-misc, exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6530us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.