What is the CVSS score of CVE-2026-3485?

CVE-2026-3485 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-3485?

Yes, a public proof-of-concept exploit is available for CVE-2026-3485. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-3485?

Within 24 hours: Identify and inventory all D-Link DIR-868L devices in your environment and isolate affected units from production networks if operationally feasible. Within 7 days: Implement network segmentation to restrict SSDP traffic (UDP port 1900) and disable UPnP/SSDP on affected devices if business operations permit. Within 30 days: Develop a device replacement plan with D-Link support for patched firmware or hardware, and conduct full network assessment for signs of compromise.

Dir 868l Firmware CVE-2026-3485

CRITICAL

Command Injection (CWE-77)

2026-03-03 cna@vuldb.com

Command Injection D-Link Dir 868l Firmware

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted SSDP request with malicious ST parameter
Exploit

SSDP Service passes unsanitized input to os command
Impact

Execute arbitrary commands as root

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	D-Link DIR-868L running firmware 110b03 with SSDP Service enabled (default state). No authentication required. Remote exploitation possible over network against default configuration.
Impact	CVSS 9.8, EPSS 0.40%.
Exploit ScenarioDerived	Inject commands via SSDP protocol.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Command injection in D-Link DIR-868L via SSDP service. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:05 CVSS 9.8

Command injection in D-Link DIR-868L SSDP.

RemediationAI

Update firmware or replace EOL device.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-77 in SSDP service.

Know when Dir 868l Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 04, 2026 - 14:07 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

A critical vulnerability (CVSS 9.8) affects D-Link DIR-868L routers, potentially allowing unauthenticated remote code execution through the SSDP service. Organizations using these devices face immediate risk of network compromise, data exfiltration, and lateral movement into connected systems. No vendor patch is currently available, requiring urgent alternative mitigation strategies.

Business Impact: Severe

Compensating Controls

Disable SSDP/UPnP service on affected D-Link DIR-868L devices via administrative interface. Implement network segmentation restricting UDP port 1900 access to trusted networks only. Deploy WAF/IDS rules to block suspicious SSDP traffic patterns. Monitor network traffic for exploitation attempts. Restrict administrative access to device web interfaces. Consider replacing affected devices with alternative vendors pending patch availability. Implement continuous network monitoring for indicators of compromise.

Threat Intelligence Overview

EPSS Score

0.4%

Top 40% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:o:dlink:dir-868l_firmware:110b03:*:*:*:*:*:*:*

More in Dir 868l Firmware

View all

CVE-2016-5681 CRITICAL Emergency

9.8 Aug 25

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx befor

CVE-2019-17621 CRITICAL Act Now POC

9.8 Dec 30

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated rem

CVE-2019-16190 CRITICAL Act Now POC

9.8 Sep 09

SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 de

CVE-2018-6530 CRITICAL Act Now POC

9.8 Mar 06

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_

CVE-2018-10957 HIGH This Week POC

8.8 May 10

CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. Rated high severity (CV

CVE-2019-7642 HIGH This Week POC

7.5 Mar 25

D-Link routers with the mydlink feature have some web interfaces without authentication requirements. Rated high severit

CVE-2018-6529 MEDIUM This Month POC

6.1 Mar 06

XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR

CVE-2018-6528 MEDIUM This Month POC

6.1 Mar 06

XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DI

CVE-2018-6527 MEDIUM This Month POC

6.1 Mar 06

XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous version

CVE-2023-39668 CRITICAL Act Now

9.8 Aug 18

D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in

CVE-2023-39667 CRITICAL Act Now

9.8 Aug 18

D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in

CVE-2023-39665 CRITICAL Act Now

9.8 Aug 18

D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.

Same weakness CWE-77 – Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2016-3081 HIGH POC

8.1

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

CVE-2015-2051 HIGH POC

8.8

CVE-2017-6327 HIGH POC

8.8

CVE-2023-34960 CRITICAL POC

9.8

Same technique Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

References

Advisories & patches

REF https://vuldb.com/?ctiid.348560 REF https://vuldb.com/?id.348560 REF https://vuldb.com/?submit.764759 REF https://www.dlink.com/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back