D-Link DAP-1160L: OS command injection in diagnostic web endpoint
Summary
The web endpoint /htdocs/web/diagnostic.php of the D-Link DAP-1160L wireless access point, firmware A1_FW101WWb04, does not filter shell metacharacters in the ping diagnostic parameter. An authenticated attacker with low privileges can inject operating system commands and run them with the device's privileges, which could allow full control of the device. The CVSS score is 8.8 (High); the authentication requirement is taken from NVD and is not yet confirmed by the vendor.
Affected
- D-Link DAP-1160L, firmware A1_FW101WWb04 (only version named so far)
- Other firmware versions: Unknown.
Fixed in
- Unknown. No fixed firmware version has been published that could be confirmed.
Workaround
- No vendor-confirmed workaround.
- Keep the device off the internet and restrict access to the management interface to a dedicated admin network.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- A public proof of concept is referenced by NVD; its availability could not be fully verified.
- CISA SSVC: exploitation PoC, not automatable, total technical impact.
Our recommendation
- Inventory all DAP-1160L devices and check the firmware version.
- Remove any internet exposure of the device's web interface.
- Restrict admin access to a management VLAN and limit access to trusted users only.
- Check the D-Link security bulletin regularly and apply a firmware update once one is published.
- If no fix is released, plan to replace the device, as the model appears to be older hardware.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD mirror: CVE-2026-52356 vulners.com
- Proof of concept write-up (GitHub) github.com
- D-Link Security Bulletin www.dlink.com
- VulDB: CVE-2026-52356 vuldb.com
- GCVE/cvelistv5 record (CISA SSVC data) db.gcve.eu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:41.
Original description (NVD)
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.