D-Link DAP1160L CVE-2026-52356

Exploitation requires network reachability to the D-Link DAP1160L web management interface and a low-privilege authenticated session to that interface (CVSS PR:L), after which arbitrary shell metacharacters injected into the /htdocs/web/diagnostic.php endpoint are executed by the underlying OS. No user interaction is required (UI:N). Limiting factors: the attacker must be able to reach the admin interface (typically LAN-side or an exposed/remotely-managed unit) and must authenticate, so devices not exposing their management interface to untrusted networks are not remotely exploitable by anonymous attackers. The specific vulnerable parameter and the exact injection trigger within diagnostic.php are not described in the available sources. This is limited to the DAP1160L A1 running firmware FW101WWb04 as reported.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable command injection with low attack complexity and full CIA impact, but requiring low-level privileges (PR:L) - i.e. an authenticated session to the device management interface rather than fully unauthenticated access. The other signals temper this: EPSS is only 0.84% (58th percentile), the vulnerability is NOT in CISA KEV, and the vuln.today decision label is 'monitor' rather than act_now or emergency - so there is no evidence of active exploitation. A public PoC reference exists on GitHub (a public PoC reference exists; it is not verified as working exploit code), which raises the practical exploitability above a purely theoretical flaw but does not equal confirmed exploitation. These signals are consistent rather than conflicting: high technical severity on a low-prevalence consumer device, no in-the-wild activity, and a reachable PoC. Net assessment: a genuinely serious device-takeover bug for exposed/managed D-Link DAP1160L units, but a moderate real-world priority overall given the authentication requirement, low EPSS, absence of KEV listing, and the device's limited deployment footprint. Note the PR:L caveat - exploitation presupposes the attacker can reach and authenticate to the admin interface, which should be verified against each deployment's exposure.

An attacker who can reach the DAP1160L web management interface and holds low-privilege credentials (or default/weak credentials) sends a crafted request to /htdocs/web/diagnostic.php containing shell metacharacters, causing the embedded OS to execute attacker-supplied commands, typically with the privileges of the web server process (commonly root on such embedded devices). A public PoC reference exists; it is not verified as working exploit code. The exact injected parameter and trigger are not described in the available sources.