D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service…
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.
Why it matters now
EPSS 0.01521 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dlink:dir-865l_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | D-Link Japan K.K. |
| cpe:2.3:h:dlink:dir-865l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | D-Link Japan K.K. |
- cpe:2.3:o:dlink:dir-865l_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
- cpe:2.3:h:dlink:dir-865l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-4855
- 2026-10-03 Alias added: GHSA-27mm-4p4v-5qpj
References
More D-Link Japan K.K. Dir-865l Firmware vulnerabilities
- TI-2019-13149 The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-04810 OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10773 D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. CVSS 3.1HIGH 8.8
- TI-2013-04261 D-Link DIR-865L has PHP File Inclusion in the router xml file. CVSS 3.1CRITICAL 9.8
- TI-2020-10777 D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. CVSS 3.1HIGH 8.8
- TI-2019-14574 D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure… CVSS 3.1HIGH 7.5
Sources
- CVE-2013-4855 · CVE Program
- CVE-2013-4855 · NVD
- FIRST EPSS
- GHSA-27mm-4p4v-5qpj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences