EUVD-2026-20855Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to HNAP1 interface
-
ExploitAccess SetNetworkSettings handler in prog.cgi
-
ExecutionInject OS command in IPAddress parameter
-
ImpactExecute arbitrary command with router privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires high-privilege authenticated access to D-Link DIR-882 firmware version 1.01B02. Attacker must send a crafted request to prog.cgi HNAP1 SetNetworkSettings Handler with malicious IPAddress parameter. Product is end-of-life and no longer supported. |
| Impact | CVSS 7.3 reflects high confidentiality/integrity impact via unauthenticated remote command injection in EOL firmware. However, attack requires high privileges (PR:H), significantly limiting real-world exploitation. Moderate observed exploitation activity. Primary risk limited to legacy, unsupported devices still deployed in isolated networks. |
| Exploit ScenarioDerived | Authenticated administrator accesses HNAP1 SetNetworkSettings handler in prog.cgi and injects OS commands via malicious IPAddress parameter. Publicly available exploit code exists; successful injection executes arbitrary commands with device privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in D-Link DIR-882 router (firmware 1.01B02) allows authenticated remote attackers to execute arbitrary system commands via malicious IPAddress parameter to prog.cgi HNAP1 SetNetworkSettings handler. Requires high privileges (PR:H) but achieves full system compromise (CVSS 7.3). Publicly available exploit code exists. Product discontinued; vendor no longer provides security updates.
RemediationAI
No vendor-released patch identified at time of analysis. D-Link has discontinued support for DIR-882 hardware. Organizations must replace affected devices with currently supported router models from D-Link or alternative vendors. As immediate mitigation: disable remote administration interfaces, restrict HNAP access to trusted management networks only via firewall rules, implement network segmentation to isolate vulnerable devices, and monitor for unauthorized configuration changes. Advisory details: https://vuldb.com/vuln/356329 and vendor EOL notice: https://www.dlink.com/. Device replacement is the only permanent remediation for end-of-life products with publicly available exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Buffer overflow in sprintf() function within prog.cgi HNAP1 SetNetworkSettings handler (CWE-78). Insufficient input sanitization of IPAddress argument enables shell metacharacter injection. Authenticated attacker submits crafted HNAP request containing shell commands embedded in network configuration parameters, triggering execution under router process context.
Know when Dir 882 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. The manipulation of the argument IPAddress results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
CVE-2026-5844 is a critical remote code execution vulnerability in discontinued D-Link DIR-882 routers that allows authenticated administrative users to execute arbitrary commands and fully compromise network infrastructure. Organizations still operating these devices face complete loss of router control and potential lateral movement into connected networks, with no vendor patch forthcoming.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HNAP1 access (prog.cgi) via firewall rules to trusted administrative IP ranges only; (2) Implement network segmentation to isolate router management interfaces from general user traffic; (3) Disable remote management features if business operations permit; (4) Deploy network-based intrusion detection targeting SetNetworkSettings exploitation patterns; (5) Establish enhanced logging and monitoring of administrative access to affected devices; (6) Plan immediate hardware replacement as primary remediation strategy given product discontinuation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB