Is there a public PoC exploit available for CVE-2026-11555?

Yes, a public proof-of-concept exploit is available for CVE-2026-11555. Prioritise patching immediately. EPSS: 0.1%.

D-Link DGS-1100-08PD CVE-2026-11555

Q: What is the CVSS score of CVE-2026-11555?

CVE-2026-11555 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35178 LOW

Least Privilege Violation (CWE-272)

2026-06-08 VulDB

GHSA-gr54-fjx7-fj9c

Information Disclosure D-Link Dgs 1100 08Pd

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:34 vuln.today

CVSS changed

Jun 08, 2026 - 18:22 NVD

3.7 (LOW) 2.9 (LOW)

DescriptionCVE.org

A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Interface. Such manipulation leads to least privilege violation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

AnalysisAI

Least privilege violation in the D-Link DGS-1100-08PD managed switch firmware version 1.00.006 allows remote unauthenticated attackers to achieve low-integrity impact through improper processing of the Boa web server configuration file /etc/boa.conf via the device's web interface. The CVSS 4.0 score is 2.9 (Low), reflecting high attack complexity (AC:H) and constrained impact (VI:L only), though a publicly available proof-of-concept lowers the barrier for skilled attackers. No active exploitation has been confirmed in CISA KEV, making this a low-priority but trackable risk for network operators deploying this switch model.

Technical ContextAI

The D-Link DGS-1100-08PD is a managed 8-port PoE Gigabit Ethernet switch running an embedded web interface powered by the Boa HTTP server, a lightweight single-threaded web server commonly deployed in resource-constrained embedded and IoT devices. The vulnerability resides in the processing of /etc/boa.conf, the Boa server's primary configuration file, which governs web interface behavior, CGI execution paths, and access controls. CWE-272 (Least Privilege Violation) identifies the root cause: a process or component operates with more privileges than its function requires, enabling manipulation beyond the intended access scope. In this context, the web interface component's handling of boa.conf may expose configuration manipulation or information to callers that should not have that level of access. The CPE string cpe:2.3:a:d-link:dgs-1100-08pd:*:*:*:*:*:*:*:* uses a wildcard version field, meaning NVD has not bounded the affected range beyond the reported 1.00.006 firmware.

RemediationAI

No vendor-released patch or specific fixed firmware version was identified at time of analysis. Operators should monitor D-Link's official product page at https://www.dlink.com/ and the VulDB entry at https://vuldb.com/vuln/369165 for firmware updates targeting CVE-2026-11555. As an immediate compensating control, restrict access to the DGS-1100-08PD web management interface to trusted management VLANs or administrative hosts only, using ACLs or firewall rules to block TCP port 80/443 from untrusted network segments - this directly addresses the AV:N attack vector by eliminating remote reachability. Disabling remote web management entirely where CLI or SNMP management is sufficient eliminates the attack surface for this vulnerability without significant operational impact in most environments. These mitigations are effective because AC:H exploitation already requires specific conditions; removing remote web interface access raises that bar substantially. No side effects from access restriction are expected beyond loss of GUI-based management from non-administrative hosts.