What is the CVSS score of CVE-2026-4184?

CVE-2026-4184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-4184?

Yes, a public proof-of-concept exploit is available for CVE-2026-4184. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4184?

Within 24 hours: Identify and inventory all D-Link DIR-816 devices on the network and isolate them from critical systems. Within 7 days: Develop an emergency replacement plan for affected devices and communicate timelines to stakeholders. Within 30 days: Complete replacement of all vulnerable DIR-816 units with supported, current-generation network equipment.

Dir 816 CVE-2026-4184

EUVD-2026-12239 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-03-15 VulDB

Buffer Overflow D-Link Stack Overflow Dir 816 D-Link

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request to /goform/form2Wl5BasicSetup.cgi
Exploit

Inject oversized pskValue parameter
Execution

Overflow stack buffer in goahead parser
Impact

Execute arbitrary code on router

Vulnerability Assessment

Weakness	CWE CWE-121 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	D-Link DIR-816 firmware version 1.10CNB05 with goahead web server enabled on default HTTP port. No authentication required. Vulnerable parameter pskValue in form2Wl5BasicSetup.cgi endpoint must accept unbounded input without validation.
Impact	This vulnerability presents an extremely high real-world risk. The CVSS 3.1 score of 9.8 reflects the worst-case scenario: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), with complete compromise of confidentiality, integrity, and availability. The 'E:P' in the vector indicates proof-of-concept code exists, which is confirmed by the GitHub exploit link. While no EPSS score or KEV listing was provided, the combination of public exploit availability, remote unauthenticated attack vector, and end-of-life product status makes this a critical priority for any organization still using these devices.
Exploit ScenarioDerived	An attacker can remotely exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface at /goform/form2Wl5BasicSetup.cgi with an oversized 'pskValue' parameter. This requires no authentication or user interaction. The publicly available proof-of-concept at https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_88/88.md demonstrates the attack methodology. Successful exploitation grants the attacker complete control over the router, potentially allowing them to intercept traffic, pivot to internal networks, or use the device for malicious purposes.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to execute arbitrary code without authentication. A public proof-of-concept exploit is available on GitHub, making this vulnerability actively exploitable. However, D-Link no longer supports this product, meaning no patch will be released.

RemediationAI

Since D-Link no longer supports the DIR-816 router, no official patch will be released. Organizations must immediately replace these devices with supported alternatives. As temporary mitigations: (1) Disable remote management if enabled, (2) Restrict access to the web interface using firewall rules to trusted IP addresses only, (3) Monitor for suspicious traffic to /goform/form2Wl5BasicSetup.cgi. The vendor's general security information can be found at https://www.dlink.com/, but no specific advisory exists for this EOL product.

Affected VersionsENISA

DIR-816 1.10CNB05

Affected Packages

euvd dir_816 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the goahead web server component, specifically in the /goform/form2Wl5BasicSetup.cgi file that handles wireless configuration settings. The flaw (CWE-121: Stack-based Buffer Overflow) occurs when the 'pskValue' parameter is processed without proper bounds checking, allowing an attacker to overflow the stack buffer. Based on the CPE string (cpe:2.3:a:d-link:dir-816:*:*:*:*:*:*:*:*), all versions of the DIR-816 firmware may be affected, though only version 1.10CNB05 has been confirmed vulnerable.

Know when Dir 816 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

CVE Published

Mar 15, 2026 - 17:32 nvd

CRITICAL 9.8

DescriptionCVE.org

A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/form2Wl5BasicSetup.cgi of the component goahead. Performing a manipulation of the argument pskValue results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability (CVE-2026-4184, CVSS 9.8) affects D-Link DIR-816 routers with publicly available exploits. Any organization using this end-of-life device is at immediate risk of complete network compromise, as attackers can remotely execute arbitrary code without authentication.

Business Impact: Severe

Compensating Controls

Network segmentation to isolate affected routers from sensitive systems; disable remote management access; implement network-based intrusion prevention signatures to detect exploitation attempts; consider deployment of a Web Application Firewall (WAF) in front of the device to block malicious requests to /goform/form2Wl5BasicSetup.cgi; restrict network access to the router's management interface to authorized administrator IPs only.

Threat Intelligence Overview

EPSS Score

0.1%

Top 81% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.