Vulnerability record · CVE-2023-36091 · published 31 July 2023

CVE-2023-36091: Dlink dir-895l firmware incorrect authorization vulnerability

Dlink · Dir 895l Firmware

Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

9.8 CVSS 3.1 Critical EPSS 1.5% · top 27.4% CWE-863 · Incorrect authorization

9.8CVSS 3.1 base score

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Dir 895l Firmware Dlink

References

Link	Tags
https://www.dlink.com/en/security-bulletin/	Vendor Advisory
https://www.dlink.com/en/support	Not Applicable
https://www.dlink.com/en/security-bulletin/	Vendor Advisory
https://www.dlink.com/en/support	Not Applicable

Track CVE-2023-36091 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-17621D-Link DIR-859 UPnP gena.cgi unauthenticated command injectionThe UPnP endpoint /gena.cgi on D-Link DIR-859 firmware 1.05 and 1.06B01 Beta01 fails to sanitize input in an HTTP SUBSCRIBE request, allowing OS comm…KEVEPSS 90%analysed30 Dec 2019 9.8CVE-2017-14948Dlink dir-868l firmware classic buffer overflow vulnerabilityCertain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary cod…EPSS 4.9%14 Oct 2019 9.8CVE-2019-16190Dlink dir-868l firmware improper authentication vulnerabilitySharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication B…EPSS 2.7%9 Sep 2019 9.8CVE-2016-6563D-Link DIR routers stack buffer overflow via HNAP SOAP loginMalformed SOAP messages sent to the HNAP Login action overflow a stack buffer in several D-Link DIR router models. The vulnerable XML fields are Acti…EPSS 80%analysed13 Jul 2018 7.5CVE-2019-20213Dlink dir-859 firmware injection vulnerabilityD-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnc…EPSS 2.2%2 Jan 2020 9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 88%11 Aug 2026 8.8CVE-2026-42016JFrog Artifactory token scope bypass enables privilege escalationJFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond…KEVEPSS 8.6%analysed27 Jul 2026 10.0CVE-2025-54253Adobe Experience Manager Forms misconfiguration allows pre-auth code executionAdobe Experience Manager Forms 6.5.23 and earlier contain a misconfiguration (CWE-863, incorrect authorization) that lets an attacker bypass security…KEVEPSS 88%analysed5 Aug 2025

Source: NIST National Vulnerability Database (record CVE-2023-36091), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.