EUVD-2026-29345
GHSA-vwxw-q9j2-rh5v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI endpoint requires low-privilege auth (PR:L); command injection yields root OS execution, changing scope and causing full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to execute arbitrary OS commands by manipulating input passed to the sub_445E7C function via the /goform/formDMZ.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, confirmed by VulDB and referenced in EUVD-2026-29345. No vendor patch has been identified at time of analysis, and the device's age and regional positioning suggest it may be unsupported, leaving affected deployments permanently exposed absent compensating controls.
Technical ContextAI
The affected component is the DMZ configuration CGI handler at /goform/formDMZ.cgi, a common pattern in MIPS-based embedded Linux firmware used in SOHO routers. The vulnerable function sub_445E7C (identified by its binary offset, indicating analysis via firmware reverse engineering) fails to sanitize user-supplied input before passing it to a shell command, conforming to CWE-77 (Improper Neutralization of Special Elements used in a Command). This class of vulnerability in CGI-based router firmware typically results in OS-level command execution with root or daemon-level privileges, as embedded web servers on such devices rarely enforce privilege separation. The CPE cpe:2.3:a:d-link:dir-816 identifies the affected product line; the specific firmware string 1.10CNB05_R1B011D88210 suggests a Chinese-market (CNB) regional build, narrowing the realistic deployed population.
RemediationAI
No vendor-released patch has been identified at time of analysis; given the regional, legacy nature of this firmware build, D-Link may treat this device as end-of-life. Users should check https://www.dlink.com/ for firmware updates specific to the DIR-816 CNB product line. In the absence of a patch, the most effective compensating control is to disable remote management and restrict access to the router's web administration interface to trusted LAN segments only, preventing unauthenticated or low-trust network principals from reaching /goform/formDMZ.cgi. If DMZ configuration is not actively used, disabling the DMZ feature entirely removes the attack surface at the cost of that routing functionality. Placing the router behind an upstream firewall that blocks inbound administrative-port access (typically TCP 80/443/8080) on the WAN interface provides an additional perimeter layer. Device replacement with a supported model is the recommended long-term remediation given the likely absence of future patches.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wi
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute a
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arb
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today