Which versions of D-Link are affected by CVE-2026-5844?

CVE-2026-5844 is a critical remote code execution vulnerability in discontinued D-Link DIR-882 routers that allows authenticated administrative users to execute arbitrary commands and fully…

Is there a public PoC exploit available for CVE-2026-5844?

Yes, a public proof-of-concept exploit is available for CVE-2026-5844. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-5844?

Within 24 hours: Identify all D-Link DIR-882 devices (firmware 1.01B02 and earlier) in your network using asset management tools and network scanning. Within 7 days: Isolate affected devices to a segregated management VLAN with restricted administrative access, and document business justification for any continued use. Within 30 days: Execute hardware replacement with vendor-supported router models and retire all DIR-882 units from production.

D-Link CVE-2026-5844

Q: What is the CVSS score of CVE-2026-5844?

CVE-2026-5844 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-20855 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

D-Link Command Injection

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 05:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 05:15 euvd

EUVD-2026-20855

Analysis Generated

Apr 09, 2026 - 05:15 vuln.today

CVE Published

Apr 09, 2026 - 04:45 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. The manipulation of the argument IPAddress results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.

Technical ContextAI

Buffer overflow in sprintf() function within prog.cgi HNAP1 SetNetworkSettings handler (CWE-78). Insufficient input sanitization of IPAddress argument enables shell metacharacter injection. Authenticated attacker submits crafted HNAP request containing shell commands embedded in network configuration parameters, triggering execution under router process context.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link has discontinued support for DIR-882 hardware. Organizations must replace affected devices with currently supported router models from D-Link or alternative vendors. As immediate mitigation: disable remote administration interfaces, restrict HNAP access to trusted management networks only via firewall rules, implement network segmentation to isolate vulnerable devices, and monitor for unauthorized configuration changes. Advisory details: https://vuldb.com/vuln/356329 and vendor EOL notice: https://www.dlink.com/. Device replacement is the only permanent remediation for end-of-life products with publicly available exploit code.