Which versions of D-Link are affected by CVE-2026-4465?

Organizations using A flaw should be aware of moderate risk from CVE-2026-4465, a command injection vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2026-4465?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

D-Link CVE-2026-4465

Q: What is the CVSS score of CVE-2026-4465?

CVE-2026-4465 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-13482 LOW

Command Injection (CWE-77)

2026-03-20 cna@vuldb.com

D-Link Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13482

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formSysCmd. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

OS command injection in D-Link DIR-513 1.10 via the /goform/formSysCmd endpoint allows authenticated remote attackers to execute arbitrary commands with network access. The vulnerability stems from insufficient input validation of the sysCmd parameter and has public exploit code available. No patch is available, and affected devices are no longer supported by D-Link.

Technical ContextAI

This vulnerability is rooted in improper input validation of the sysCmd parameter passed to the formSysCmd handler in the D-Link DIR-513's web administration interface, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The affected device is a small-office/home-office (SOHO) router running embedded Linux-based firmware version 1.10, which processes user-supplied command arguments without adequate escaping or sandboxing before passing them to shell execution functions. The vulnerability chain involves the web application accepting authenticated requests to /goform/formSysCmd, parsing the sysCmd POST/GET parameter, and directly interpolating it into a system call without filtering shell metacharacters (pipes, semicolons, backticks, command substitution syntax). The D-Link DIR-513 is a legacy access point device; the specific CPE would be cpe:2.3:h:dlink:dir-513:1.10 or similar hardware designation combined with firmware versioning.

RemediationAI

Immediate action is required despite the lack of vendor patches: discontinue use of D-Link DIR-513 devices and replace them with current, actively maintained access point or routing hardware from vendors with established security update processes. Organizations unable to immediately hardware-replace DIR-513 units should implement compensating controls including complete network isolation of the device (place on a segregated management VLAN with strict access control lists), disable remote management access entirely, enforce strong authentication on any local management interfaces, and monitor network traffic from the device for signs of command injection exploitation or data exfiltration. Do not rely on firmware updates or configuration workarounds, as the underlying architectural flaw cannot be reliably patched on end-of-life hardware. For temporary risk reduction pending replacement, restrict access to the /goform/formSysCmd endpoint via firewall rules at the network perimeter and consider blocking outbound connections from the device to limit the impact of compromised command execution.