CVE-2026-110536

Deferred Deferred - Pending Action

Command Injection in D-Link DIR-868L Router

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulDB

Description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110536

EUVD

EUVD-2026-101590

Affected Vendors & Products

Vendor	Product	Version / Range
D-Link	DIR-868L	2.01b05

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an unauthenticated OS command injection vulnerability in D-Link DIR-868L routers. It exists in the HNAP interface, specifically in the /htdocs/cgibin binary where the SOAPACTION HTTP header is improperly validated. Attackers can inject malicious commands into the SOAPACTION header which are executed as root via the system() function. The router's web server runs CGIs with root privileges, allowing full remote code execution.

Detection Guidance

Use the PoC scripts from Resource 2 to test for the vulnerability. For example, run hnap_http_poc.sh or poc_hnap_injection.py against the target router's IP address to check for command injection.
Monitor network traffic for unusual HTTP requests targeting the /htdocs/cgibin endpoint with manipulated SOAPACTION headers.
Check router logs for unexpected command executions or errors related to the HNAP CGI handler.

Impact Analysis

An attacker could remotely execute arbitrary commands on your router with root privileges without authentication. This could allow them to take control of your network, intercept traffic, install malware, or use your router as a pivot point to attack other devices on your network.

Compliance Impact

This vulnerability allows unauthenticated remote code execution as root on the affected D-Link DIR-868L router, enabling attackers to fully compromise the device. Such unauthorized access could lead to exposure or manipulation of sensitive data processed or stored on the router, violating confidentiality and integrity requirements under GDPR and HIPAA. The lack of authentication bypass and root-level access exacerbates compliance risks by enabling data breaches or unauthorized system modifications.

Mitigation Strategies

Update the router's firmware to the latest version if a patch is available from D-Link.
Disable remote administration access to the router if not required.
Block external access to the HNAP interface (port 80/443) via firewall rules until patched.
Replace the vulnerable substring check in the HNAP CGI handler with an exact whitelist comparison as described in Resource 1.

Hi! I’m here to help you understand CVE-2026-110536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70