D-Link DIR-868L: OS command injection in HNAP CGI handler
Summary
An unauthenticated attacker on the network can inject operating system commands through the HNAP interface of the D-Link DIR-868L router with firmware 2.01b05. The SOAPACTION HTTP header is checked with a substring match, which bypasses the authentication check. Injected commands run as root, and the attacker can read the output. A public proof of concept exists, and D-Link has ended support for this model, so no fix is expected.
Affected
- D-Link DIR-868L, firmware 2.01b05 (hardware revision B1 according to the public advisory)
- Other firmware versions and hardware revisions: Unknown.
Fixed in
Unknown. D-Link has announced end of life for the DIR-868L family, and no patch is expected.
Workaround
- No vendor-approved workaround known.
- Remove port forwarding and remote management that exposes the router's web interface to the internet.
- Place the router behind a firewall or isolate it from sensitive systems.
Exploitation
- Public proof of concept available (CISA SSVC: exploitation poc, automatable yes, technical impact total).
- No known exploitation in the wild at the time of writing.
Our recommendation
- Replace the DIR-868L with a supported device as soon as possible.
- Until replacement, block all internet access to the router's management and web interface and check for port forwarding.
- Isolate the router on a separate network segment and monitor for unexpected outbound connections or configuration changes.
- Re-check the CISA KEV catalogue for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Security advisory (GitHub, Walnut1337) github.com
- Proof of concept repository (GitHub) github.com
- VulDB entry VDB-419825 vuldb.com
- VulDB CTI entry VDB-419825 vuldb.com
- D-Link support announcement SAP10397 (end of life) supportannouncement.us.dlink.com
- D-Link support announcement SAP10189 (end of support) supportannouncement.us.dlink.com
- Vulners exploit record E09C6C76 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:45.
Original description (NVD)
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
NVD references (8)
- https://github.com/Walnut1337/Command-Injection-DIR-868L/blob/main/ADVISORY.md
- https://github.com/Walnut1337/Command-Injection-DIR-868L/tree/main/poc
- https://vuldb.com/cve/CVE-2026-110536
- https://vuldb.com/submit/1003692
- https://vuldb.com/submit/1003693
- https://vuldb.com/vuln/419825
- https://vuldb.com/vuln/419825/cti
- https://www.dlink.com/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.