Which versions of D-Link are affected by CVE-2026-4499?

D-Link DIR-820LW routers are vulnerable to remote command injection attacks without authentication or patch availability, potentially allowing attackers to gain complete control of affected network…

Is there a public PoC exploit available for CVE-2026-4499?

Yes, a public proof-of-concept exploit is available for CVE-2026-4499. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-4499?

Within 24 hours: Identify all DIR-820LW routers in your environment and isolate them from critical network segments; document inventory and access points. Within 7 days: Implement network-based mitigations (WAF rules blocking HTTP_ST manipulation, restricted access to SSDP ports); begin evaluation of router replacement options. Within 30 days: Replace affected devices with patched alternatives or supported models; validate remediation through network scanning and conduct risk assessment of any systems accessed through compromised routers.

D-Link CVE-2026-4499

Q: What is the CVSS score of CVE-2026-4499?

CVE-2026-4499 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-13800 MEDIUM

OS Command Injection (CWE-78)

2026-03-20 VulDB

Command Injection D-Link

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 19:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 19:46 euvd

EUVD-2026-13800

Analysis Generated

Mar 20, 2026 - 19:46 vuln.today

CVE Published

Mar 20, 2026 - 19:32 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

An OS command injection vulnerability exists in the D-Link DIR-820LW router firmware version 2.03, specifically in the ssdpcgi_main function of the SSDP component. The vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands via manipulation of the HTTP_ST environment variable. A proof-of-concept exploit has been publicly disclosed on GitHub, making this an immediate concern for organizations using affected devices.

Technical ContextAI

The vulnerability resides in the Simple Service Discovery Protocol (SSDP) implementation of the D-Link DIR-820LW router, specifically within the ssdpcgi_main function. SSDP is part of UPnP (Universal Plug and Play) and is used for network device discovery. The affected product is identified by CPE cpe:2.3:a:d-link:dir-820lw:*:*:*:*:*:*:*:*. This is classified as CWE-78 (OS Command Injection), meaning the application constructs operating system commands using externally-influenced input without properly neutralizing special elements. The HTTP_ST environment variable, which should be treated as untrusted user input, is improperly handled and allows injection of shell metacharacters that are then executed by the underlying system with the privileges of the web server process.

RemediationAI

Users should immediately check the D-Link support website at https://www.dlink.com/ for firmware updates addressing this vulnerability in the DIR-820LW router. If no patch is available and the device is end-of-life, organizations should consider replacing the affected hardware with supported models. As interim mitigations, disable SSDP/UPnP functionality if not required for business operations, restrict network access to the router's management interface to trusted IP addresses only, and place affected devices behind a firewall that blocks external access to UPnP services (typically UDP port 1900 and related TCP ports). Given the age of the firmware version (2.03) and D-Link's history of discontinuing support for older consumer routers, device replacement may be the most viable long-term solution.