{"id":"CVE-2018-6530","kind":"vulnerability","aliases":["CVE-2018-6530"],"related":[],"title":"OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L…","description":"Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.\n\nCISA required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","summary":"Multiple D-Link router models contain an unspecified flaw that lets someone run operating system commands on the device. CISA lists it as actively exploited, and the KEV entry ties it to ransomware campaigns.","severity":"critical","cvss":10.0,"epss":0.96682,"exploited":true,"exploited_at":"2022-09-08T00:00:00+00:00","products":[{"name":"D-Link Multiple Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dir-860l firmware","fixed":[],"affected":"<= 1.10b04","ecosystem":"vendor"},{"name":"dlink dir-865l firmware","fixed":[],"affected":"<= 1.08b01","ecosystem":"vendor"},{"name":"dlink dir-868l firmware","fixed":[],"affected":"<= 1.12b04","ecosystem":"vendor"},{"name":"dlink dir-880l firmware","fixed":[],"affected":"<= 1.08b04","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","exploited","home-network","infrastructure","ransomware","routers","self-hosted"],"not_affected_if":["firmware-patched","no-d-link-router"],"how_to_check":"Identify any D-Link routers on your network and their model and firmware version. Compare against D-Link's advisory for CVE-2018-20114, which the KEV note says patches this issue.","fix":"Update the router firmware to the version D-Link's advisory for CVE-2018-20114 lists as fixed. If the model is end-of-life with no fix, disconnect it or replace it.","status":"open","published_at":"2018-03-06T20:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:44+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:10:44Z","model":"claude-haiku-5-5","output":{"fix":"Update the router firmware to the version D-Link's advisory for CVE-2018-20114 lists as fixed. If the model is end-of-life with no fix, disconnect it or replace it.","reach":"unknown","impact":"high","summary":"Multiple D-Link router models contain an unspecified flaw that lets someone run operating system commands on the device. CISA lists it as actively exploited, and the KEV entry ties it to ransomware campaigns.","category":"infrastructure","who_cares":["d-link","routers","self-hosted","home-network"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the router and can pivot into the network.","analyst_note":"Sources do not list affected models or fixed firmware versions; check D-Link's advisory for CVE-2018-20114 and the KEV entry's model list, and confirm the network reach.","how_to_check":"Identify any D-Link routers on your network and their model and firmware version. Compare against D-Link's advisory for CVE-2018-20114, which the KEV note says patches this issue.","needs_analyst":true,"not_affected_if":["no-d-link-router","firmware-patched"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2908,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-20114':130C '-2018':19A,22A,129C,136C '-6530':20A,23A,137C '860l':32A '865l':37A '868l':42A '880l':17A,47A 'action':115C 'activ':86B 'advisori':123C 'affect':151C 'allow':107C 'appli':144C 'campaign':96B 'cgibin':10A 'cisa':82B,113C 'command':2A,78B,112C 'contain':68B,102C 'cve':18A,21A,128C,135C 'd':13A,25A,50B,64B,99C,119C 'd-link':12A,24A,49B,63B,98C,118C 'devic':81B,140C,152C 'dir':16A,31A,36A,41A,46A 'dir-860l':30A 'dir-865l':35A 'dir-868l':40A 'dir-880l':15A,45A 'disconnect':164C 'dlink':29A,34A,39A,44A 'end':158C 'end-of-lif':157C 'enter':155C 'entri':91B,134C 'execut':109C 'exploit':52B,87B 'firmware':33A,38A,43A,48A 'fix':126C 'flaw':71B 'home':54B 'home-network':53B 'host':61B 'infrastructur':56B 'inject':3A 'instruct':148C 'kev':90B,133C 'let':73B 'life':160C 'link':14A,26A,51B,65B,100C,120C 'list':83B 'main':8A 'model':67B 'multipl':62B,97C 'multiple':27A 'network':55B 'oper':76B 'os':1A,111C 'patch':132C 'per':146C 'proper':131C 'publish':121C 'ransomwar':57B,95B 'requir':114C 'router':58B,66B,101C 'routers':28A 'run':75B 'self':60B 'self-host':59B 'sinc':154C 'soap.cgi':6A 'soapcgi':7A 'someon':74B 'state':124C 'still':142C,166C 'support':143C 'system':77B 'tie':92B 'unspecifi':70B,104C 'updat':145C 'use':168C 'vendor':117C,147C 'vulner':4A,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-03-06T20:29:00+00:00","kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","requiredAction":"The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-6530","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6530","severity":null,"published_at":"2022-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2018-6530","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6530","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-6530","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6530","severity":null,"published_at":"2018-03-06T20:29:00+00:00","modified_at":"2026-06-17T02:01:58+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}