# D-Link Published articles for D-Link. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## D-Link warns of multiple zero-days in DGS-3130 Series switches DevFeed: [D-Link warns of multiple zero-days in DGS-3130 Series switches]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-11-06T12:37:22Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [network device monitoring]() Tags: [access-control](), [admin](), [authentication](), [backups](), [changes](), [computer-help](), [computer-security](), [computers](), [configuration](), [credentials](), [cve](), [d-link](), [data](), [deployments](), [device](), [dgs-3130](), [dgs-3130-30ts](), [dir-822a](), [discovery](), [disrupt](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [security](), [spyware](), [support](), [switch](), [switches](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [warning](), [windows](), [zero-day](), [zero-days]() ### AI overview D-Link says multiple unpatched flaws affect several firmware versions of its DGS-3130-30TS switches; the company has not disclosed CVE IDs or full technical details, and is still assessing other platforms. The researcher linked the issues to D-Link Discovery Protocol (DDP) authentication, access control, and information handling. Exploitation by someone with access to the affected network could expose device data or SNMP communities, enable unauthorized administrative or configuration changes, or disrupt services and reset devices. Until firmware updates are available, D-Link recommends disabling DDP, removing unnecessary or default SNMP community strings, limiting SSH, web UI, and SNMP access to isolated management networks and designated admin hosts, keeping offline configuration backups, and checking logs for unexpected changes, reboots, or factory resets. ### Source excerpt D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. [...] ## Hackers Hijack D-Link, Ubiquiti Devices To Resell Your Stolen Bandwidth DevFeed: [Hackers Hijack D-Link, Ubiquiti Devices To Resell Your Stolen Bandwidth]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-10-16T11:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [residential proxy network](), [tailscale](), [Network Attached Storage (NAS)](), [Credential theft](), [ssh](), [Synology]() Tags: [backup](), [cve-2021-44228](), [d-link](), [greynoise](), [network](), [proxyjacking](), [residential-proxy-network](), [ssh](), [ubiquiti]() ### AI overview A proxyjacking campaign compromised devices in 34 countries by exploiting vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composer to install Pawns.app and resell victims' bandwidth. GreyNoise identified at least 143 compromised devices; some attackers also configured SSH key authentication for backup access. ### Source excerpt An anonymous reader quotes a report from BleepingComputer: A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software. Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems. Read more of this story at Slashdot. ## D-Link warns of max severity zero-day bug in DIR-822A routers DevFeed: [D-Link warns of max severity zero-day bug in DIR-822A routers]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-09-22T12:48:06Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Cybersecurity](), [Vulnerabilities](), [Exploit](), [DHCP](), [Wi-Fi](), [Firewall](), [DDoS]() Tags: [buffer-overflow](), [cisa](), [computer-help](), [computer-security](), [computers](), [cve](), [d-link](), [ddos](), [dhcp](), [dir-822a](), [firewall](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [memory](), [poc](), [proof-of-concept](), [rce](), [remote-code-execution](), [router](), [routers](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [windows](), [zero-day]() ### AI overview D-Link warned of a maximum-severity vulnerability in legacy DIR-822A dual-band Wi-Fi routers. The flaw is a stack-based buffer overflow in the DHCP server and has publicly available proof-of-concept exploit code. A second vulnerability affecting L2TP configurations is also under investigation, and patches are not yet available. ### Source excerpt D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers. [...] ## Detecting Exploitation w/ VulnCheck Initial Access Intelligence - November 2024 DevFeed: [Detecting Exploitation w/ VulnCheck Initial Access Intelligence - November 2024]() Original publisher: [Read original article]() Author: Patrick Garrity Published: 2024-12-11T00:00:00Z Content type: news Language: en Sources: [VulnCheck]() Topics: [intelligence](), [OSINT]() Tags: [artifacts](), [citrix](), [code-execution](), [command-and-control](), [containers](), [cves](), [d-link](), [detection](), [docker](), [edge](), [exploit](), [exploitation](), [exploited](), [exploits](), [fortinet](), [go](), [initial-access](), [intelligence](), [products](), [vulncheck]() ### AI overview VulnCheck released Initial Access Intelligence artifacts for 15 CVEs across 14 vendors and products in November 2024; 11 of those 14 had confirmed exploitation activity by December 11. The covered products include edge devices from Palo Alto, Citrix, D-Link, Fortinet, and Netgear. Artifacts may include exploits, version scanners, PCAPs, Suricata and Snort rules, YARA rules, internet-search queries, and target Docker containers. The text also reports that public-facing ProjectSend instances appeared exploited and that 99% remained vulnerable as of November 25 despite an August patch; public exploits had appeared months before CVE assignment. VulnCheck's Go-based PoCs and scanners use its maintained go-exploit library and are provided with a Dockerfile. ### Source excerpt In November 2024, VulnCheck developed new Initial Access Intelligence (IAI) artifacts for 15 CVEs, covering 14 different vendors and products. ## A Peek Into the Known Exploited Vulnerabilities of 2024 DevFeed: [A Peek Into the Known Exploited Vulnerabilities of 2024]() Original publisher: [Read original article]() Author: Patrick Garrity Published: 2024-12-05T00:00:00Z Content type: news Language: en Sources: [VulnCheck]() Topics: [known exploitable vulnerabilities](), [common vulnerabilities and exposures](), [Jupyter Notebook]() Tags: [apache](), [apple](), [apple-ios](), [automated](), [cisa-kev](), [cisco](), [d-link](), [exploit](), [exploitation](), [exploited](), [exploited-vulnerabilities](), [github](), [jupyter](), [jupyter-notebook](), [visibility](), [vulncheck](), [vulnerabilities]() ### AI overview VulnCheck's public Jupyter Notebook compares its KEV data with CISA KEV and is automatically updated daily. For 2024 year to date, VulnCheck recorded 717 vulnerabilities with exploitation evidence and coverage of 410 vendors, compared with CISA's 170 vulnerabilities and 56 vendors. The notebook also explores trends with dashboards, interactive treemaps, and calendar charts. VulnCheck reports that in 53.4% of historical CISA KEV cases, public exploitation evidence appeared more than a month before CISA's addition; same-day evidence often coincided with Patch Tuesday. The notebook uses VulnCheck's Python SDK and community edition. The excerpt says users can sign up for the community edition, download the notebook, enter an API key, and modify it to explore the data. These figures and observations reflect the article's stated dataset and period. ### Source excerpt VulnCheck now provides an automated approach to providing broader visibility into differences between VulnCheck KEV and CISA KEV through a Jupyter Notebook publicly available on GitHub.