Vulnerabilities · 3h ago

D-Link DIR-868L PoC leaves EOL routers exposed

CSIRT-ITA says a public proof of concept now exists for CVE-2026-110536 in the D-Link DIR-868L, a remote code execution flaw scored CVSS 10. The router is end of support, and D-Link will not ship a patch or workaround.

The bug sits in the HNAP handling inside the router’s web components. A crafted HTTP request can be accepted as trusted management input, letting a remote unauthenticated attacker inject commands and run code as root.

For any DIR-868L still reachable from the WAN or other untrusted networks, the exposure does not go away on its own because there is no fix path. The remaining question is whether the device is still in service and still reachable; if so, it stays a live remote-root target until it is removed or isolated.

CVE-2026-110536

NVD KEV

CVSS 10 CRITICAL: a vulnerability was determined in D-Link DIR-868L 2.01b05.

Timeline

Oct 15 Reported by CSIRT Italia / ACN
Oct 14 Reported by CVE Program records

Sources

2 sources covering this story

CSIRT Italia / ACN Oct 15
D-Link: disponibile PoC per lo sfruttamento della CVE-2026-110536
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-110536, presente in dispositivi DIR-868L non più supportati.
CVE Program records Oct 14
D-Link DIR-868L HNAP CGI cgibin system os command injection
A vulnerability was determined in D-Link DIR-868L 2.01b05.

Entities

CVE-2026-110536

Part of the PlainSec briefing for 2026-10-15

Editions

Briefing for 2026-10-15

Vulnerabilities · 3h agoD-Link DIR-868L PoC leaves EOL routers exposedCSIRT-ITA says a public proof of concept now exists for CVE-2026-110536 in the D-Link DIR-868L, a remote code execution flaw scored CVSS 10. The router is end of support, and D-Link will not ship a patch or workaround.The bug sits in the HNAP handling inside the router’s web components. A crafted HTTP request can be accepted as trusted management input, letting a remote unauthenticated attacker inject commands and run code as root.For any DIR-868L still reachable from the WAN or other untrusted networks, the exposure does not go away on its own because there is no fix path. The remaining question is whether the device is still in service and still reachable; if so, it stays a live remote-root target until it is removed or isolated.