Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by VulDB

CVE-2026-110536D-Link DIR-868L HNAP CGI cgibin system os command injection

Critical 10.0

In plain English

A critical-severity OS command injection in DIR-868L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

VendorProductVersions
D-Link DIR-868L 2.01b05

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References