{"id":"CVE-2026-110536","published":"2026-10-14T19:17:10Z","modified":"2026-10-15T15:17:28Z","title":"A vulnerability was determined in D-Link DIR-868L 2.01b05","vendor":"D-Link","product":"DIR-868L","tier":"core","eol":null,"description":{"text":"A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the HNAP CGI Handler component of the D-Link DIR-868L router firmware (version 2.01b05), within the /htdocs/cgibin file, lets crafted input in the SOAPACTION argument reach the operating system shell as an OS command injection. An attacker can exploit it remotely over the network with no authentication and no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:55Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02934,"percentile":0.87059,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 23, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ada23770d71749da2321a29","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad8d3466c8181f05516bab7","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad78144340f998d3db4d0bc","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad62f761b14c745b837b947","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad4ddb44d734735b605dc2f","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad38c34c49c0273168a0f7d","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad23abd6cb9332fcbb88e3b","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ad0e94086fc75fcda994436","created":"2026-10-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/Walnut1337/Command-Injection-DIR-868L/blob/main/ADVISORY.md","tags":[]},{"url":"https://github.com/Walnut1337/Command-Injection-DIR-868L/tree/main/poc","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-110536","tags":[]},{"url":"https://vuldb.com/submit/1003692","tags":[]},{"url":"https://vuldb.com/submit/1003693","tags":[]},{"url":"https://vuldb.com/vuln/419825","tags":[]},{"url":"https://vuldb.com/vuln/419825/cti","tags":[]},{"url":"https://www.dlink.com/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-101590","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101590","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110536","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.41,"detail":"percentile 0.8706"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}