D-Link DIR-868L CVE-2026-110536

Requires network reachability to the device's HNAP CGI handler (/htdocs/cgibin); the attacker supplies a crafted SOAPACTION argument that is passed into the vulnerable system function. No authentication, credentials, user interaction, or non-default configuration is indicated (PR:N/UI:N), so default installations exposing the HNAP service are affected. The practical limiting factor is exposure of the HNAP management interface: LAN-only reachability largely confines exploitation to the local network, whereas devices with WAN-side remote management enabled are exploitable directly from the internet. Impact is further bounded by the product itself - this affects specifically D-Link DIR-868L firmware 2.01b05, an end-of-life model.

All available signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high impact across confidentiality, integrity and availability, consistent with OS command injection (CWE-77) in a CGI handler that typically runs as root on embedded routers. The vector's E:P (Proof-of-Concept) exploit-maturity flag aligns with the independently reported public POC on GitHub, reinforcing that working exploit code exists. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The CVE is NOT listed in CISA KEV per the provided data, so despite a public exploit there is no confirmation of active in-the-wild exploitation - the current status is publicly available exploit code, not confirmed exploitation. The one mitigating real-world factor is product status: the DIR-868L is an older, end-of-life D-Link consumer router, so the absolute population of exposed devices is smaller than for current flagship products, and internet exposure depends on remote-management being reachable. Net: a real, actionable high-severity issue for any environment still running this device, tempered by its retired/niche footprint rather than by any technical difficulty.

A remote attacker sends a crafted HNAP request to the router's /htdocs/cgibin endpoint with a malicious SOAPACTION header value that is passed unsanitized into a system() call, injecting arbitrary OS commands executed with the CGI process's privileges (typically root). A public proof-of-concept is available on GitHub (Walnut1337/Command-Injection-DIR-868L), lowering the skill required; given AV:N/AC:L/PR:N/UI:N the attack needs only network reachability to the HNAP service and no authentication or user interaction.