Skip to main content

D-Link DHP-1320 CVE-2026-4529

| EUVDEUVD-2026-14260 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-03-21 VulDB GHSA-95m4-fmhv-g399
7.4
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Apr 30, 2026 - 16:44 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 30, 2026 - 16:37 vuln.today
cvss_changed
CVSS changed
Apr 30, 2026 - 16:37 NVD
8.8 (HIGH) 7.4 (HIGH)
PoC Detected
Mar 23, 2026 - 14:31 vuln.today
Public exploit code
EUVD ID Assigned
Mar 21, 2026 - 23:15 euvd
EUVD-2026-14260
Analysis Generated
Mar 21, 2026 - 23:15 vuln.today
CVE Published
Mar 21, 2026 - 23:02 nvd
HIGH 8.8

DescriptionCVE.org

A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in D-Link DHP-1320 PowerLine AV adapter (firmware 1.00WWB04) allows remote authenticated attackers to execute arbitrary code with full device control via malformed SOAP requests to the redirect_count_down_page function. Publicly available exploit code exists on GitHub (confirmed by VulDB). EPSS score of 0.04% (14th percentile) indicates low observed exploitation in the wild despite POC availability. Product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices.

Technical ContextAI

This vulnerability affects the SOAP (Simple Object Access Protocol) handler implementation in D-Link DHP-1320 PowerLine network adapters, which use SOAP for remote device management and configuration. The stack-based buffer overflow (CWE-121) occurs in the redirect_count_down_page function when processing SOAP requests. PowerLine adapters transmit network data over electrical wiring and often include web-based management interfaces that accept SOAP commands for configuration. A stack-based buffer overflow overwrites the call stack with attacker-controlled data, allowing execution flow hijacking and arbitrary code execution at the privilege level of the SOAP handler process. The CPE identifier cpe:2.3:a:d-link:dhp-1320 confirms the D-Link DHP-1320 as the sole affected product.

RemediationAI

No vendor-released patch exists or will be developed as D-Link discontinued the DHP-1320 product line and ended security support. IMMEDIATE ACTION REQUIRED: Replace all DHP-1320 devices with currently supported PowerLine adapters or alternative networking solutions from active product lines. Organizations unable to immediately replace devices must implement network segmentation to isolate DHP-1320 adapters on separate VLANs with strict firewall rules blocking all inbound management traffic from untrusted networks. Disable SOAP-based remote management interfaces entirely if the device supports local-only configuration (verify in firmware settings under remote access controls). Implement strong authentication credentials if remote management cannot be disabled, though this only raises attacker cost without eliminating the vulnerability. Monitor network traffic to DHP-1320 management ports (typically TCP 80/443) for anomalous SOAP request patterns as detection control. Note that all mitigations except hardware replacement are temporary compensating controls with operational trade-offs: disabling remote management prevents legitimate remote administration, network isolation adds configuration complexity, and credential strengthening does not prevent exploitation by attackers who obtain valid credentials through phishing or credential reuse.

Share

CVE-2026-4529 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy