EUVD-2026-29349
GHSA-r83p-32gc-q9c8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection with low-privilege auth; command execution on embedded Linux router warrants High C/I/A regardless of reported Low ratings.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
AnalysisAI
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ip_address argument passed to the portForward function without sanitization. A public proof-of-concept is available on GitHub, lowering the skill bar for exploitation. No CISA KEV listing exists, but EPSS places this at the 66th percentile, indicating greater exploitation likelihood than two-thirds of all tracked CVEs.
Technical ContextAI
The affected product is the D-Link DIR-816 consumer wireless router running firmware 1.10CNB05_R1B011D88210 (CPE: cpe:2.3:a:d-link:dir-816). The vulnerability is located in the portForward web UI function, where the ip_address parameter is concatenated into an OS-level shell command without sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: shell metacharacters or separators embedded in the user-supplied value are interpreted by the underlying embedded Linux shell rather than treated as inert data. This pattern is endemic to embedded router firmware where CGI handlers invoke shell utilities directly to configure networking functions such as iptables or ip commands, making unsanitized input immediately weaponizable.
RemediationAI
No vendor-released firmware patch has been identified at time of analysis. Monitor the D-Link security advisory portal (https://www.dlink.com/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-8346) for patch availability. As compensating controls, immediately restrict access to the router's web management interface to trusted LAN-only segments and disable remote (WAN-side) management if enabled - this removes the network attack vector by requiring physical adjacency, mitigating the AV:N risk at the cost of eliminating remote administration capability. Where feasible, place DIR-816 devices behind a perimeter firewall that blocks inbound connections to management ports (typically TCP 80/443/8080). Changing router credentials away from defaults reduces the PR:L exploitation risk by raising the credential acquisition bar for attackers.
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 router firmware version 1.10CNB05, affecting the wi
Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote a
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows authenticated remote attackers to execute arb
Command injection in D-Link DIR-816 firmware 1.10CNB05_R1B011D88210 allows a network-adjacent authenticated attacker to
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today