D-Link DHP-1320 CVE-2026-4529

Remote exploitation requires valid authentication credentials to the DHP-1320 web management interface (CVSS PR:L indicating low-privilege user access sufficient). The SOAP-based remote management feature must be enabled and accessible over the network - this is typically the default configuration for D-Link PowerLine adapters. No user interaction is required once authenticated access is obtained (UI:N). The vulnerability affects only the specific DHP-1320 hardware model running firmware 1.00WWB04, though exploitation likely succeeds against other firmware versions for this device given the end-of-life status and lack of historical security updates. Exploitation is limited to attackers who can reach the device's management interface, typically requiring presence on the local network or internet exposure of the management port (less common for residential PowerLine adapters but possible in misconfigured deployments).

Real-world risk assessment presents conflicting signals requiring careful evaluation. CVSS 4.0 score of 7.4 indicates high severity with remote network attack vector (AV:N), low complexity (AC:L), and requires low-privilege authentication (PR:L) but achieves complete compromise (VC:H/VI:H/VA:H). The SSVC framework marks this as 'poc' exploitation status with 'total' technical impact but NOT automatable, suggesting exploitation requires device-specific knowledge rather than mass-scanning capability. However, EPSS probability of 0.04% (14th percentile) indicates minimal observed exploitation activity despite public POC availability since the GitHub repository publication. This low EPSS score likely reflects the limited deployment footprint of end-of-life PowerLine adapters rather than low exploitability. CRITICAL LIMITING FACTOR: Product discontinued by D-Link with no vendor support, meaning affected population shrinks naturally over time through hardware replacement. The requirement for authenticated access (PR:L) significantly reduces attack surface compared to unauthenticated remote code execution. Priority assessment: HIGH for organizations still operating DHP-1320 devices (immediate replacement required due to EOL status), MEDIUM for network defenders (low prevalence limits mass exploitation risk), LOW for internet-wide threat landscape (EPSS confirms minimal active targeting).

An attacker authenticated to the DHP-1320's web management interface (via default credentials, credential stuffing, or compromised local network access) sends a specially crafted SOAP request with oversized parameters to the redirect_count_down_page endpoint. The vulnerable function copies attacker-controlled data into a fixed-size stack buffer without length validation, overwriting the return address. When the function returns, execution jumps to attacker-supplied shellcode that establishes persistent backdoor access with full device privileges. From the compromised PowerLine adapter, the attacker pivots to other devices on the electrical network segment and monitors all traffic passing through the adapter. The publicly available GitHub POC demonstrates the exact buffer overflow trigger, lowering exploitation barrier for opportunistic attackers.