CVE-2026-110536 is a critical (CVSS 3.1: 10.0), unauthenticated, remotely exploitable OS command injection flaw in the HNAP CGI handler of D-Link DIR-868L firmware 2.01b05, and a public proof-of-concept exploit has been released.
What Is It
The flaw is in the system function of /htdocs/cgibin, inside the router's HNAP CGI Handler component. An attacker can manipulate the SOAPACTION argument to inject operating system commands. The CNA (VulDB) classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
NVD published the record on 2026-10-14, and it is currently in "Received" status. That means NVD has not yet completed its own analysis. All scoring below comes from the CNA.
Why It Matters
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The attack works over the network, needs low complexity, no privileges and no user interaction, and its impact reaches beyond the vulnerable component (scope changed). - CVSS 4.0: 9.3 CRITICAL. Exploit maturity is rated Proof-of-Concept.
- CVSS 2.0: 10.0, with complete confidentiality, integrity and availability impact.
The advisory states that "the exploit has been publicly disclosed and may be utilized." The researcher's GitHub repository includes both an advisory and a PoC directory.
KEV status: The supplied CISA KEV data contains no entry for this CVE. Active exploitation in the wild is not confirmed by KEV at this time. The public PoC does, however, lower the barrier to exploitation.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| D-Link | DIR-868L | HNAP CGI Handler (/htdocs/cgibin) |
2.01b05 |
CPE: cpe:2.3:h:d-link:dir-868l:*:*:*:*:*:*:*:*
The supplied data lists only firmware 2.01b05 as affected. It does not say whether other versions are affected.
Patch Status
The supplied NVD record does not reference a vendor patch, fixed firmware version or vendor security advisory. The only vendor reference is D-Link's general homepage. No KEV entry exists, so there is no CISA-mandated required action or due date.
Owners of DIR-868L devices running 2.01b05 should check D-Link directly for firmware updates or guidance. Until fixed firmware is confirmed, treat the HNAP interface as exposed to unauthenticated remote command injection.