What is the CVSS score of CVE-2026-2193?

CVE-2026-2193 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Di 7100g C1 Firmware are affected by CVE-2026-2193?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-2193, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-2193?

Yes, a public proof-of-concept exploit is available for CVE-2026-2193. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-2193?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Di 7100g C1 Firmware CVE-2026-2193

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-08 cna@vuldb.com

Command Injection D-Link Di 7100g C1 Firmware

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 11, 2026 - 18:37 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 23:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argument usb_username results in command injection. Remote exploitation of the attack is possible.

AnalysisAI

Command injection in D-Link DI-7100G C1 firmware version 24.04.18D1 allows authenticated remote attackers to execute arbitrary commands through manipulation of the usb_username parameter in the set_jhttpd_info function. Public exploit code exists for this vulnerability, and no patch is currently available. The medium-severity flaw requires valid credentials but can be exploited over the network with minimal complexity.

Technical ContextAI

Affects Di-7100G C1 Firmware. A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argument usb_username results in command injection. Remote exploitation of the attack is possible.