D-Link DGS-1100-08PD CVE-2026-11555

CVSS PR:N confirms no authentication is required to attempt exploitation. CVSS AC:H confirms high attack complexity - exploitation is not straightforward and requires meeting specific, non-default conditions in how the web interface processes /etc/boa.conf; exact preconditions (e.g., specific request structure, timing, or parameter state) are described in the publicly available POC but are not detailed in NVD or vendor advisory data. The attack targets the web management interface, so the web interface must be reachable from the attacker's network position - if access to the management interface is restricted to a dedicated management VLAN, remote exploitation is blocked. No user interaction is required (UI:N) and no subsequent system impact is present (SC:N/SI:N/SA:N), limiting blast radius strictly to the vulnerable switch's web component. Exploitation does not appear to require any specific non-default configuration beyond having the default web interface enabled, which is typical for this device class.

The overall risk is low, corroborated by the CVSS 4.0 base score of 2.9. The attack vector is network (AV:N), meaning no physical access is required, but attack complexity is rated high (AC:H), indicating that exploitation depends on specific conditions, configurations, or exploit knowledge that are not trivially met. Privileges required are none (PR:N) and no user interaction is needed (UI:N), which are factors that would normally elevate concern, but these are offset by AC:H and the minimal impact scope: only low integrity impact on the vulnerable component (VI:L) with no confidentiality or availability impact confirmed by CVSS. The exploit maturity modifier E:P confirms a proof-of-concept exists, which removes the research barrier but does not equate to weaponized or in-the-wild exploitation. No EPSS score was provided in source data, preventing probabilistic exploitation likelihood comparison. This is not listed in the CISA KEV catalog, confirming no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag in VulDB metadata conflicts slightly with the CVSS showing only integrity impact (VI:L, VC:N) - this discrepancy should be verified with the vendor, as the actual impact may include partial configuration or path disclosure through the boa.conf processing pathway.

A remote attacker with knowledge of the specific exploitation technique - or armed with the publicly available proof-of-concept linked on Notion (https://www.notion.so/D-link-DGS-1100-08PD-v1-00-006-3670ed14e5cb80848bc4e3129dfafa29) - sends crafted HTTP requests to the DGS-1100-08PD web interface targeting the /etc/boa.conf processing path. By satisfying the high-complexity preconditions (e.g., specific request sequencing, race condition, or parameter manipulation), the attacker triggers a least privilege violation that allows low-level modification or partial disclosure of configuration state beyond what the web interface should permit. The impact is constrained to low integrity impact on the switch's web component, making this more relevant to configuration tampering than full device compromise.