What is the CVSS score of EUVD-2026-12235?

EUVD-2026-12235 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-12235?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12235. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-12235?

Within 24 hours: Inventory all D-Link DIR-816 devices across the organization and isolate any identified units from production networks. Within 7 days: Either decommission affected devices or implement network-level mitigations (see compensating controls). Within 30 days: Complete replacement with supported hardware and validate remediation through vulnerability scanning.

Dir 816 EUVD-2026-12235

| CVE-2026-4182 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-03-15 VulDB

Buffer Overflow D-Link Stack Overflow Dir 816 D-Link

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request to /goform/form2Wl5RepeaterStep2.cgi
Exploit

Inject oversized payload in key1/key2/key3/key4/pskValue parameters
Execution

Trigger stack buffer overflow in goahead parser
Impact

Execute arbitrary code with device privileges

Vulnerability Assessment

Weakness	CWE CWE-121 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	D-Link DIR-816 firmware version 1.10CNB05 with goahead web server enabled; remote unauthenticated access to HTTP interface on default port 80; no authentication required for /goform/form2Wl5RepeaterStep2.cgi endpoint.
Impact	This represents a critical real-world risk with multiple alarming indicators: CVSS 9.8 (Critical) with network-accessible attack vector (AV:N), low complexity (AC:L), and no authentication required (PR:N). The availability of a public exploit (E:P) significantly increases the threat level. The CVSS impact metrics show complete compromise possible (C:H/I:H/A:H). While EPSS data is not provided, the combination of public exploit availability, remote exploitability without authentication, and the fact these are internet-facing devices makes this a priority issue. The only mitigating factor is that affected products are end-of-life, limiting the installed base.
Exploit ScenarioDerived	An attacker can remotely exploit this vulnerability by sending specially crafted HTTP requests to the router's web interface at /goform/form2Wl5RepeaterStep2.cgi, providing oversized values for the key1-4 or pskValue parameters. This triggers a stack buffer overflow, allowing arbitrary code execution with router privileges. Since no authentication is required and a working exploit is publicly available at https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_86/86.md, attacks could be automated to compromise vulnerable routers exposed to the internet.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router (version 1.10CNB05) that allows remote attackers to achieve full system compromise without authentication. A public proof-of-concept exploit is available on GitHub, and the vulnerability affects end-of-life products no longer supported by D-Link, making this a high-risk issue for organizations still using these devices.

RemediationAI

As this affects end-of-life products with no vendor support, the only effective remediation is to replace affected DIR-816 routers with supported models. Temporary mitigations include: 1) Disable remote management interfaces if possible, 2) Place the device behind a firewall blocking external access to the management interface, 3) Monitor for exploitation attempts targeting /goform/form2Wl5RepeaterStep2.cgi. No patches are available as confirmed by the RL:X (Unavailable) metric in the CVSS string.

Affected VersionsENISA

DIR-816 1.10CNB05

Affected Packages

euvd dir_816 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the goahead web server component, specifically in the /goform/form2Wl5RepeaterStep2.cgi file which handles wireless repeater configuration. The flaw is a classic stack-based buffer overflow (CWE-121) where input parameters (key1/key2/key3/key4/pskValue) are not properly bounds-checked before being copied to stack buffers. The affected product CPE is cpe:2.3:a:d-link:dir-816:*:*:*:*:*:*:*:*, indicating all versions of the DIR-816 router are potentially vulnerable, though the specific confirmed version is 1.10CNB05.

Know when Dir 816 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

CVE Published

Mar 15, 2026 - 16:02 nvd

CRITICAL 9.8

DescriptionCVE.org

A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability (CVSS 9.8) has been identified in D-Link DIR-816 wireless routers with public exploit code available. Organizations using this end-of-life device face immediate risk of complete system compromise, network infiltration, and potential lateral movement into corporate infrastructure. Immediate action is required to identify affected devices and remediate exposure.

Business Impact: Severe

Compensating Controls

Implement the following interim mitigations: (1) Disable the affected /goform/form2Wl5RepeaterStep2.cgi endpoint via WAF or firewall rules; (2) Segment the affected devices to isolated VLANs with restricted east-west traffic; (3) Disable WPS/repeater functionality if not operationally required; (4) Monitor for exploit attempts targeting the specific vulnerable parameters (key1, key2, key3, key4, pskValue); (5) Restrict administrative access to the device to trusted networks only. These controls reduce but do not eliminate risk—device replacement is the only permanent solution.

Threat Intelligence Overview

EPSS Score

0.1%

Top 81% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.