Deviceways

Router

D-Link DIR-610

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
A1
Retired support documentedOpen device guide
A1
Open hardware record
Original project github.com

Recorded configuration: 4 MB flash; 32 MB RAM

Device support in source
Retired; check the documented hardware and older release resources.
First installation
see forum
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

d-link dir-610 a1 — device documentation (github.com)D-Link DIR-610 rev A1 — TechInfoDepot (github.com)D-Link DIR-610 rev A1 — WikiDevi (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
A1

OpenWrt · A1

OpenWrt · A1 — Source documentation (openwrt.org)

Installation routes recorded
see forum
Recovery routes recorded
D-Link Recovery GUI
Availability recorded by source
Discontinued

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

Listed in CISA KEV ↗CVSS 8.8 (v3.1)

D-Link DIR-610

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php

CVE-2020-9377

Affected firmware
Version scope unspecified in source
Fix
NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Read mitre CVE record
Details and sources
CVE updated

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVE published

CVSS 9.3 (v4.0)

DIR-610

D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

CVE-2026-0625

Affected firmware
Version scope unspecified
Fix
D-Link Systems, Inc. recommends retiring these products and replacing them with products that receive firmware updates.
Read VulnCheck CVE record
Details and sources
CVE updated

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).

Security advisory publication.aspx — DIR-610 (supportannouncement.us.dlink.com) ↗Security advisory publication.aspx — DIR-610 (supportannouncement.us.dlink.com) ↗Security advisory dlink dsl command injection via dns configuration endpoint — DIR-610 (vulncheck.com) ↗
CVE published

D-Link DIR-610

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php

CVE-2020-9376

Affected firmware
Version scope unspecified in source
Fix
NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Read mitre CVE record
Details and sources
CVE updated

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Check more security advisories for this device · CVE.org