Deviceways

Router

D-Link DIR-867

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
A1
Get OpenWrt firmware Release listed · 25.12.6
A1
Get firmware Release listed · 25.12.5
A1
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 16 MB flash; 128 MB RAM

First installation
D-Link Recovery GUI
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

d-link dir-867 a1 — device documentation (github.com)D-Link DIR-867 rev A1 — TechInfoDepot (github.com)D-Link DIR-867 rev A1 — WikiDevi (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
A1

OpenWrt · A1

OpenWrt · A1 — Source documentation (openwrt.org)

Installation routes recorded
D-Link Recovery GUI
Recovery routes recorded
D-Link Recovery GUI
Availability recorded by source
Discontinued 2019

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.8 (v3.1)

D-Link DIR-867

OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the…

CVE-2023-24762

Affected firmware
Version scope unspecified in source
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1.

CVE published

CVSS 8.8 (v3.0)

D-Link DIR-867

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA

CVE-2020-15633

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
CVE updated

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.

Security advisory ZDI 20 881 — D-Link DIR-867 (zerodayinitiative.com) ↗
CVE published

CVSS 8.8 (v3.0)

D-Link DIR-867

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04

CVE-2020-8864

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
CVE updated

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.

Security advisory ZDI 20 268 — D-Link DIR-867 (zerodayinitiative.com) ↗
CVE published

CVSS 8.8 (v3.0)

D-Link DIR-867

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04

CVE-2020-8863

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
CVE updated

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.

Security advisory ZDI 20 267 — D-Link DIR-867 (zerodayinitiative.com) ↗
CVE published

CVSS 8.7 (v4.0)

DIR-867

D-Link DIR-867 Query String strncpy stack-based overflow

CVE-2025-6334

Affected firmware
1.0
Fix
This vulnerability only affects products that are no longer supported by the maintainer.
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

VDB-313330 | D-Link DIR-867 Query String strncpy stack-based overflow — DIR-867 (vuldb.com) ↗VDB-313330 | CTI Indicators (IOB, IOC, IOA) — DIR-867 (vuldb.com) ↗Submit #596579 | D-Link DIR-867 DIR-867 AC1750 v.1.0 Stack-based Buffer Overflow — DIR-867 (vuldb.com) ↗
Check more security advisories for this device · CVE.org