D-Link DIR-816 CVE-2026-8345

Exploitation requires authenticated access to the DIR-816 web management interface - the CVSS 4.0 vector specifies PR:L (low privilege), meaning an attacker must first possess valid credentials before reaching the /goform/singlePortForward endpoint. The vulnerability is triggered specifically by manipulation of the ip_address parameter within the port forwarding configuration form processed by sub_445E7C; the port forwarding UI must be accessible to the authenticated session. SSVC designates this as 'not automatable', reflecting that the authentication step prevents fully scripted unauthenticated mass exploitation. Limiting factors: authentication is required and cannot be bypassed via this vulnerability alone; the confirmed affected scope is firmware 1.10CNB05_R1B011D88210 only; the router's web management interface must be network-reachable from the attacker's position (LAN by default, WAN only if remote management is explicitly enabled). Scope does not extend to adjacent systems per the CVSS 4.0 SC:N/SI:N/SA:N ratings.

The provided CVSS 4.0 score of 2.1 with VC:L/VI:L/VA:L significantly understates the realistic impact of command injection on an embedded router - arbitrary OS command execution on these devices typically yields full root-level control of the device, its firewall rules, and the traffic it routes. This is a notable signal conflict: the vulnerability class (command injection) and the SSVC 'partial' technical impact rating are difficult to reconcile, and analysts should treat the low impact scores with skepticism pending vendor clarification. The EPSS score of 0.50% at the 66th percentile is moderate for IoT CVEs and reflects a non-trivial but not imminent exploitation probability. SSVC designates exploitation as 'poc' with 'not automatable', the latter consistent with the PR:L authentication requirement that prevents fully weaponized mass scanning. No CISA KEV listing exists, confirming no confirmed widespread exploitation at time of analysis. The primary real-world risk limiter is the authentication prerequisite - an attacker must first hold valid web interface credentials - combined with the narrow market footprint of this specific Chinese-market firmware build.

An attacker with knowledge of valid DIR-816 web interface credentials - obtained via default credential reuse (D-Link devices commonly ship with admin/admin) or internal network position - submits a crafted HTTP POST request to /goform/singlePortForward with an ip_address value such as '127.0.0.1;id;' or a reverse shell payload. The sub_445E7C function passes this value unsanitized to a shell command, executing arbitrary OS instructions with the privilege level of the web server process. A public proof-of-concept detailing this technique is available at https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/2.md.