Overview
The D-Link DIR-842 all hardware revisions referenced in this advisory are legacy, non-U.S. products that reached End of Life (EOL) / End of Support (EOS) on January 15, 2024.
D-Link recommends that products that have reached EOL/EOS be retired and replaced with currently supported devices.
Customers outside the United States should contact their applicable D-Link regional office for product availability, support information, and replacement recommendations.
When a product reaches EOL/EOS, D-Link generally discontinues firmware development, security updates, and technical support for that product. Because these DIR-842 hardware revisions are no longer supported, no additional firmware development is planned.
Please review the information and recommendations below.
Security Report Information
CVE-2026-19893 CVE Reference: CVE-2026-19893
A third-party security report identifies an issue affecting D-Link DIR-842 firmware version 2.01.B04 associated with the vsftpd service configuration.
The published CVE describes an incorrect default permissions condition associated with:
/etc/vsftpd.conf
The CVE record identifies the issue under:
The affected DIR-842 product referenced by this advisory is a legacy product that is no longer supported by D-Link.
Previously Reported Third-Party Information
Researcher:
huanBIn Ruan
doudoudedi233 at gmail dot com
Originally Reported: January 4, 2021
A separate third-party report concerning DIR-842 Revision A and Revision B firmware identified a potential boundary condition within the Qrs_setFirewallRule function of the ncc2 binary service.
According to the researcher, the function processes an IP-address range used when configuring router firewall rules. The report described a condition involving the copying of a 128-byte value between fixed-size buffers using strcpy, potentially allowing a terminating null byte to be written beyond the destination buffer boundary.
The researcher reported that this condition could result in modification of adjacent stack data and disruption of the device's web-management service.
This previously reported issue is separate from CVE-2026-19893.
Affected Legacy Models
| Model |
Region |
Hardware Revision |
End of Support |
Legacy Website |
Advisory Updated |
| DIR-842 |
All Regions |
All Revisions |
01/15/24 |
Yes (here) |
08/17/2026 |
Important: DIR-842 products were manufactured in multiple hardware revisions and for multiple regional markets. Firmware is specific to the applicable hardware revision and region. Customers should verify the hardware revision printed on the device label before referencing firmware or support information.
Recommendation for End-of-Life / End-of-Support Products
From time to time, D-Link determines that products have reached End of Life (EOL) or End of Support (EOS) as technologies, standards, market requirements, and product platforms evolve.
Once a product reaches EOL/EOS, D-Link generally discontinues:
As a result, vulnerabilities or other issues identified after the EOL/EOS date may not be corrected.
For the DIR-842 hardware revisions covered by this advisory, no additional firmware development is planned.
D-Link recommends replacing these legacy devices with currently supported products.
For U.S. Consumers
The DIR-842 hardware revisions identified in this advisory are non-U.S. legacy product revisions.
U.S. customers who possess one of these devices should verify the exact model number and hardware revision located on the product label.
For any D-Link product that has reached EOL/EOS, D-Link recommends retiring and replacing the product with a currently supported device.
If a owners/users legacy device remains temporarily in service while replacement is arranged which against D-Link's instructions above:
-
Use the most recent firmware previously released for the exact hardware revision and region.
-
Use a strong, unique password for the device's administrative interface.
-
Enable Wi-Fi encryption using a strong, unique wireless password.
-
Disable remote-management functionality when it is not required.
-
Replace the device with a currently supported product as soon as practical.
For assistance identifying an appropriate replacement product, please contact D-Link Customer Service or your applicable regional D-Link office.