D-Link DIR-816 CVE-2026-8344

Exploitation requires the attacker to hold valid credentials to the DIR-816 web administration interface, consistent with the CVSS 4.0 PR:L (low-privilege authentication required) metric. The vulnerable code path is reachable via the /goform/formDMZ.cgi endpoint, meaning the DMZ configuration feature must be accessible - this is a standard, enabled-by-default feature on most DIR-series routers. No special non-default configuration is required beyond network reachability to the admin interface. Exploitation is limited by the authentication prerequisite: an attacker without credentials must first obtain them through default credential abuse, brute force, credential theft, or a chained authentication bypass vulnerability. The SSVC 'automatable: no' classification further indicates that mass exploitation without per-target credential acquisition is not straightforward. Local network positioning is not required - the web interface is typically reachable over the WAN interface if remote management is enabled, or over LAN.

Multiple signals present a mixed but meaningful risk picture. The assigned CVSS 4.0 score of 2.1 appears anomalously low for a network-exploitable command injection with a public POC - this likely reflects VulDB's conservative impact ratings (VC:L/VI:L/VA:L) rather than the actual technical impact of OS command injection on a router. An independent assessment yields a materially higher severity. EPSS at 0.50% (66th percentile) indicates moderate exploitation likelihood relative to the vulnerability universe, which is notable given the POC's existence. SSVC characterizes exploitation as 'poc', automatable as 'no', and technical impact as 'partial' - the non-automatable classification is significant, suggesting attackers cannot trivially mass-exploit this at scale and must identify and authenticate to each target individually. The device is not currently listed in the CISA KEV catalog, so confirmed in-the-wild exploitation is unverified. The primary real-world risk is targeted abuse by an authenticated actor (e.g., a compromised admin session, default credentials, or a secondary vulnerability enabling authentication bypass) against unpatched devices that are likely end-of-life and receiving no vendor updates.

An attacker who has obtained credentials to the DIR-816 web interface - whether through default credentials, credential stuffing, or a separate authentication bypass - navigates to the DMZ configuration endpoint and submits a crafted HTTP request containing shell metacharacters in the parameters processed by sub_445E7C. A public proof-of-concept exploit is available at https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/1.md, providing a concrete attack template. Because the underlying web server on such devices typically runs as root, successful injection results in arbitrary command execution with full OS-level privileges on the router.