D-Link DIR-816 CVE-2026-8346

Exploitation requires low-privilege authenticated access to the DIR-816 web management interface (CVSS 4.0 PR:L), meaning the attacker must possess valid router credentials before the attack can proceed. The portForward feature must be accessible via the web UI - this is a standard networking function enabled by default on consumer routers and does not require non-default configuration. No special operating mode or feature flag is required beyond credential possession. Exploitation is constrained by the authentication requirement (PR:L), the need to reach the management interface (LAN-side by default, or WAN-side if remote management is enabled), and SSVC's 'Automatable: no' designation, which indicates that automated mass exploitation at internet scale is not straightforward with current tooling.

The provided CVSS 4.0 score of 2.1 with Low impact ratings (VC:L/VI:L/VA:L) appears significantly underrated for a network-reachable command injection - command injection on embedded Linux firmware typically enables full device compromise, which would warrant High impact across all CIA axes. This discrepancy between the reported score and expected real-world impact should be independently verified with D-Link. SSVC classifies this as poc exploitation (public PoC confirmed), Automatable: no, and technical impact: partial, which partially supports the low-impact rating but remains inconsistent with standard command injection outcomes. EPSS at 0.50% and the 66th percentile signals moderate relative exploitation risk versus the broader CVE population. The 'Automatable: no' SSVC flag reduces mass-exploitation concern. Real-world priority is moderate-to-high for defenders who manage DIR-816 devices: the authentication barrier (PR:L) is the primary limiting factor, but a public PoC and no confirmed patch make this actionable.

An attacker who has obtained low-privilege credentials to the DIR-816 web interface - via credential stuffing, default passwords, or prior reconnaissance - sends a crafted HTTP POST to the portForward endpoint, embedding shell metacharacters such as a semicolon or backtick in the ip_address field. The router firmware passes the unsanitized string directly to an OS shell command, executing the attacker's injected payload on the embedded Linux system. A public proof-of-concept is available at https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/3.md, which a moderately skilled attacker can adapt with minimal modification.