---
id: "CVE-2018-6530"
kind: "vulnerability"
aliases: ["CVE-2018-6530"]
title: "OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L\u2026"
severity: "critical"
cvss: 10.0
epss: 0.96682
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link Multiple Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dir-860l firmware", "fixed": [], "affected": "<= 1.10b04", "ecosystem": "vendor"}, {"name": "dlink dir-865l firmware", "fixed": [], "affected": "<= 1.08b01", "ecosystem": "vendor"}, {"name": "dlink dir-868l firmware", "fixed": [], "affected": "<= 1.12b04", "ecosystem": "vendor"}, {"name": "dlink dir-880l firmware", "fixed": [], "affected": "<= 1.08b04", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "exploited", "home-network", "infrastructure", "ransomware", "routers", "self-hosted"]
not_affected_if: ["firmware-patched", "no-d-link-router"]
published_at: "2018-03-06T20:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6530", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-6530", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6530", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L…

Multiple D-Link router models contain an unspecified flaw that lets someone run operating system commands on the device. CISA lists it as actively exploited, and the KEV entry ties it to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link Multiple Routers affected ? fixed ?
- vendor:dlink dir-860l firmware affected <= 1.10b04 fixed ?
- vendor:dlink dir-865l firmware affected <= 1.08b01 fixed ?
- vendor:dlink dir-868l firmware affected <= 1.12b04 fixed ?
- vendor:dlink dir-880l firmware affected <= 1.08b04 fixed ?

## How to check

Identify any D-Link routers on your network and their model and firmware version. Compare against D-Link's advisory for CVE-2018-20114, which the KEV note says patches this issue.

## Fix

Update the router firmware to the version D-Link's advisory for CVE-2018-20114 lists as fixed. If the model is end-of-life with no fix, disconnect it or replace it.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6530
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-6530
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-6530

## From the sources

Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

CISA required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_