Is there a public PoC exploit available for CVE-2026-8345?

Yes, a public proof-of-concept exploit is available for CVE-2026-8345. Prioritise patching immediately. EPSS: 0.5%.

D-Link DIR-816 CVE-2026-8345

Q: What is the CVSS score of CVE-2026-8345?

CVE-2026-8345 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-29346 LOW

Command Injection (CWE-77)

2026-05-11 VulDB

Command Injection D-Link Dir 816 D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

AV:N for web interface reachability; PR:L for authentication requirement; command injection on embedded router yields full device compromise, warranting C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:36 vuln.today

Severity Changed

May 11, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 23:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 11, 2026 - 22:00 nvd

MEDIUM 6.3

CVE Published

May 11, 2026 - 22:00 cve.org

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the ip_address parameter in the /goform/singlePortForward endpoint. The root cause is the sub_445E7C function passing unsanitized user input directly to a system command (CWE-77), and a proof-of-concept exploit has been publicly disclosed on GitHub. No active exploitation has been confirmed by CISA KEV at time of analysis, though the EPSS score places this CVE at the 66th percentile for exploitation likelihood.

Technical ContextAI

The D-Link DIR-816 is a SOHO wireless router running an embedded Linux-based firmware targeted at the Chinese consumer market (CNB build designation). The vulnerable endpoint /goform/singlePortForward is a CGI handler used to configure single-port forwarding rules; the specific function sub_445E7C processes user-supplied input for this form. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the ip_address argument is passed to a shell command or system() call without adequate sanitization, enabling injection of shell metacharacters. The confirmed affected CPE is cpe:2.3:a:d-link:dir-816:*:*:*:*:*:*:*:*, with wildcard versioning suggesting other DIR-816 firmware revisions may share the same code path, though only 1.10CNB05_R1B011D88210 is explicitly confirmed by EUVD-2026-29346.

RemediationAI

No vendor-released patch has been identified at time of analysis - D-Link's security advisory page at https://www.dlink.com/ should be monitored for any firmware update addressing this CVE; D-Link has historically not released patches for older SOHO models, making device replacement with a currently-supported model the most durable long-term remediation. As immediate compensating controls: disable WAN-side web management to ensure the router interface is reachable only from the local LAN, substantially reducing attacker reach (trade-off: loses remote management capability). Enforce strong, non-default administrative credentials on the web interface, raising the bar above the low-privilege authentication prerequisite. If the port forwarding configuration page is not operationally needed, restrict access via firewall ACLs or disable the feature in the router's administrative settings. The proof-of-concept is publicly documented at https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/2.md and can be used to verify exploitability in a controlled test environment.