D-Link DIR 890l Vulnerabilities & CVEs

Q: Is my D-Link DIR 890l affected by these vulnerabilities?

Only if you’re running a firmware version in the affected range listed above and haven’t updated. Check your router's admin panel for its current firmware version and compare it against the ranges below.

Q: How do I update my D-Link DIR 890l's firmware?

Log into the router's web admin panel (usually at its local IP address) and look for a Firmware Update or System Update section, or use the vendor's mobile app if it has one.

Q: Does ProbeShield fix these vulnerabilities for me?

No — ProbeShield scans your network and tells you what it finds (open ports, default credentials, outdated firmware signals) so you know what to fix, and how. It never changes your devices’ settings.

Known CVEs

CVE-2016-5681CRITICAL (9.8)

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 ...

Affected: versions <= 1.09Fixed in: later than 1.09

CVE-2016-6563CRITICAL (9.8)

Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPas...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2017-14948CRITICAL (9.8)

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vect...

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2019-17621CRITICAL (9.8)CISA KEV

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE re...

Affected: versions <= 1.11b01Fixed in: later than 1.11b01

CVE-2022-30521CRITICAL (9.8)

The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htd...

Affected: versions <= 1.07b09Fixed in: later than 1.07b09

CVE-2022-29778HIGH (8.8)

D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php

Affected: versions <= 1.22b01Fixed in: later than 1.22b01

CVE-2019-20213HIGH (7.5)

D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.

Affected: versions <= 1.11b01Fixed in: later than 1.11b01

CVE-2023-30063HIGH (7.5)

D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.

Affected: Not version-specific per NVD — check the advisoryFixed in: See vendor advisory

CVE-2025-8231MEDIUM (6.8)

A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04. This issue affects some unknown processing of the file rgbin of the component UART Port. The manipulation leads to har...

Affected: versions <= 1.11b04Fixed in: later than 1.11b04

CVE-2018-12103MEDIUM (6.5)

An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revi...

Affected: versions <= 1.21b02beta01Fixed in: later than 1.21b02beta01

Commonly exposed ports

Port 23 (Telnet) — Sends admin credentials unencrypted — a common target on older router firmware.
Port 80 (HTTP admin panel) — The web admin UI; dangerous if remote/WAN administration is left enabled.
Port 7547 (TR-069 (CWMP)) — ISP remote-management protocol — has been the entry point for several router botnets.
Port 1900 (UPnP/SSDP) — Lets apps on your LAN open firewall holes automatically, sometimes without your knowledge.

Default credentials

From ProbeShield's own tested default-credential list (see probeshield.com/default-passwords/): "admin" / "d-link" or "admin" / "pass" over HTTP.

Hardening checklist

Disable remote (WAN-side) administration unless you specifically need it.
Turn off UPnP unless a specific app you trust requires it.
Turn off WPS — it can let an attacker bypass your Wi-Fi password.
Change the default admin username and password to something unique.
Check for a firmware update in the router’s admin panel and apply it.
Disable Telnet/SSH management access if you don’t actively use it.

Frequently asked questions

Is my D-Link DIR 890l affected by these vulnerabilities? Only if you’re running a firmware version in the affected range listed above and haven’t updated. Check your router's admin panel for its current firmware version and compare it against the ranges below.

How do I update my D-Link DIR 890l's firmware? Log into the router's web admin panel (usually at its local IP address) and look for a Firmware Update or System Update section, or use the vendor's mobile app if it has one.

Does ProbeShield fix these vulnerabilities for me? No — ProbeShield scans your network and tells you what it finds (open ports, default credentials, outdated firmware signals) so you know what to fix, and how. It never changes your devices’ settings.

Sources: National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities Catalog. This page lists which firmware versions are affected — it doesn't claim your specific unit is vulnerable. Check your device's current firmware version in its admin panel and compare it against the ranges above.