What is the CVSS score of CVE-2026-3485?

CVE-2026-3485 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dir 868l Firmware are affected by CVE-2026-3485?

A critical vulnerability (CVSS 9.8) affects D-Link DIR-868L routers, potentially allowing unauthenticated remote code execution through the SSDP service.

Is there a public PoC exploit available for CVE-2026-3485?

Yes, a public proof-of-concept exploit is available for CVE-2026-3485. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-3485?

Within 24 hours: Identify and inventory all D-Link DIR-868L devices in your environment and isolate affected units from production networks if operationally feasible. Within 7 days: Implement network segmentation to restrict SSDP traffic (UDP port 1900) and disable UPnP/SSDP on affected devices if business operations permit. Within 30 days: Develop a device replacement plan with D-Link support for patched firmware or hardware, and conduct full network assessment for signs of compromise.

Dir 868l Firmware CVE-2026-3485

CRITICAL

Command Injection (CWE-77)

2026-03-03 cna@vuldb.com

D-Link Command Injection Dir 868l Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 04, 2026 - 14:07 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.