EUVD-2026-84394
GHSA-jr36-4wfx-rcrm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable OS command injection yielding root code execution gives AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as compromise stays within the device authorization context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the local network.
Articles & Coverage 1
AnalysisAI
Remote code execution in D-Link DAP-1360 firmware 6.14 and earlier allows unauthenticated attackers to execute arbitrary commands as root via crafted requests to the web management interface. Exploitation requires only network reachability to the device's HTTP management interface-no credentials, user interaction, or non-default configuration-and publicly available exploit code exists, making this a high-priority risk for exposed devices. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against the web management interface of D-Link DAP-1360 firmware version 6.14 and earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the latest firmware update from D-Link for the DAP-1360 as directed by the vendor security advisory SAP10451 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10451); no specific patched firmware version is provided in the available input, so verify the advisory for the fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every D-Link DAP-1360 on the estate and identify which units run firmware 6.14 or earlier; immediately block all inbound access to the device web management interface at the perimeter firewall and any internal segmentation points, and where a device must stay in service, confine its management interface to an isolated VLAN reachable only from a hardened administrative jump host. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today