CVE-2026-110536

D-Link DIR-868L HNAP CGI cgibin system os command injection

State: Published
Severity: 10.0 Critical
Published: Oct 14, 2026
Updated: Oct 15, 2026
Reserved: Oct 14, 2026

Description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	VulDB
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	10.0 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	10.0 High	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
DIR-868LD-Link	2.01b05Affected

References

VDB-419825 | D-Link DIR-868L HNAP CGI cgibin system os command injectionvdb-entrytechnical-description
VDB-419825 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-110536 | CVE Analysis and Reportthird-party-advisory
Submit #1003692 | D-Link DIR-868L Hardware rev B1, firmware 2.01b05 (web interface / HNAP, component /htdocs/cgibin) Command Injectionthird-party-advisory
Submit #1003693 | D-Link DIR-868L Hardware rev B1, firmware 2.01b05 (web interface / HNAP, component /htdocs/cgibin) Command Injection (Duplicate)third-party-advisory
https://github.com/Walnut1337/Command-Injection-DIR-868L/blob/main/ADVISORY.mdbroken-link
https://github.com/Walnut1337/Command-Injection-DIR-868L/tree/main/pocexploit
https://www.dlink.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.