What’s Vulnerable › Vulnerabilities

CVE-2022-50596: D-Link DIR-1260 <= v1.20B05 GetDeviceSettings Unauthenticated Command Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-06 · updated 2026-06-17
• Weakness: CWE-78

Description

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within the SetDest/Dest/Target arguments to the GetDeviceSettings form. The management interface is accessible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet.

Affected products

• D-Link DIR-1260: through 1.20b05

References

• https://blog.exodusintel.com/2022/05/11/d-link-dir-1260-getdevicesettings-pre-auth-command-injection-vulnerability/
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10298
• https://www.vulncheck.com/advisories/dlink-dir1260-getdevicesettings-unauthenticated-command-injection

Get alerted when CVE-2022-50596 or the next vulnerability affects your stack