EUVD-2026-12231Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to redirect.asp
-
ExploitManipulate token_id parameter
-
ExecutionBypass access controls
-
ImpactAccess unauthorized resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | D-Link DIR-816 firmware version 1.10CNB05 or earlier with goahead web server enabled. No authentication required. Affects unsupported/end-of-life devices with default configurations. |
| Impact | This vulnerability presents moderate to high real-world risk. The CVSS 3.1 score of 7.3 reflects network-accessible (AV:N), low complexity (AC:L) attacks requiring no privileges (PR:N) or user interaction (UI:N). The availability of a public POC (E:P) significantly increases exploitation likelihood. However, the impact is limited to Low for all CIA components (C:L/I:L/A:L). The vulnerability is not currently in CISA's KEV catalog, suggesting limited evidence of active exploitation in the wild. The combination of end-of-life status, public exploit availability, and authentication bypass nature makes this a priority for organizations still using affected devices, though the limited impact scope somewhat reduces severity. |
| Exploit ScenarioDerived | An attacker can remotely exploit this vulnerability by sending specially crafted HTTP requests to the redirect.asp page with manipulated token_id parameters, bypassing authentication controls. Since no authentication or user interaction is required, automated scanning and exploitation is feasible. The public POC available at https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_84/84.md provides specific exploitation details. Once exploited, attackers gain unauthorized access to router functionality, potentially allowing them to modify configurations, intercept network traffic, or use the device as a pivot point for further attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
CVE-2026-4180 is an authentication bypass vulnerability in the D-Link DIR-816 router (version 1.10CNB05) affecting the redirect.asp file in the goahead component, allowing remote attackers to gain unauthorized access without authentication. A public proof-of-concept exploit is available and the affected product is no longer supported by D-Link, making this vulnerability permanently unpatched.
RemediationAI
No patch is available as the D-Link DIR-816 is no longer supported by the manufacturer. Immediate remediation requires replacing affected devices with currently supported router models. As a temporary mitigation, organizations should: 1) Restrict network access to the device's management interface using firewall rules, 2) Disable remote management features if possible, 3) Monitor for suspicious access attempts to redirect.asp. The D-Link website (https://www.dlink.com/) should be consulted for recommended replacement products.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the goahead web server component used by the D-Link DIR-816 router (CPE: cpe:2.3:a:d-link:dir-816:*:*:*:*:*:*:*:*). The flaw is classified as CWE-284 (Improper Access Control), specifically involving improper handling of the 'token_id' parameter in redirect.asp. This allows attackers to bypass authentication mechanisms that should protect administrative or restricted functionality. The goahead web server is commonly used in embedded devices and IoT products for lightweight HTTP serving.
Know when Dir 816 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the component goahead. The manipulation of the argument token_id leads to improper access controls. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
D-Link DIR-816 routers running firmware 1.10CNB05 contain a publicly exploitable access control vulnerability that allows unauthenticated remote attackers to bypass authentication via parameter manipulation. Organizations using this end-of-life device are at immediate risk of unauthorized administrative access, and the availability of public exploits significantly increases the likelihood of active exploitation.
Implement Web Application Firewall (WAF) rules to block requests to redirect.asp with token_id parameters; restrict administrative access to the router's web interface (port 80/443) to trusted IP ranges only via firewall rules; disable remote management features and restrict access to the device's management interface to local network only; monitor network traffic for suspicious access patterns to the affected device; consider implementing network segmentation to isolate the router from critical systems and limit lateral movement risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wi
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (firmware version 1.10CNB05) that allows
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute a
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arb
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to
Exploit-DB