A stack-based buffer overflow in the authentication handler of D-Link DIR-868L 2.01b05 lets an unauthenticated remote attacker corrupt memory via the login form, and a public proof-of-concept already exists.
What Is It
CVE-2026-94089 is a stack-based buffer overflow (CWE-121, CWE-119) in the D-Link DIR-868L router firmware version 2.01b05. The flaw lives in an unsafe strcpy call inside /webfa_authentication.cgi, part of the device's Authentication Handler component. Manipulating the id or password arguments submitted to that CGI endpoint overflows a fixed-size stack buffer.
The attack is executed remotely, requires no authentication, no privileges, and no user interaction. Because the vulnerable code sits in the authentication path itself, an attacker reaches it before ever presenting valid credentials.
Why It Matters
The CVE record carries a CVSS v3.1 base score of 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a changed scope and high confidentiality, integrity, and availability impact. This score is the one supplied with the record rather than an NVD-analyzed score; NVD's own analysis is still outstanding, so the severity rating may shift when that analysis completes. A separate CVSS v4.0 assessment from VulDB scores it 9.3 CRITICAL and marks exploit maturity as Proof-of-Concept.
The exploit has been publicly disclosed and may be utilized. A crash PoC is published on GitHub, which lowers the barrier to weaponization considerably. Consumer-grade routers like the DIR-868L are typically internet-facing and rarely monitored, and the changed scope in the CVSS assessment suggests that a compromise of the authentication handler could give an attacker a foothold for reaching the network behind the device; though the published PoC demonstrates only a crash, not code execution or lateral movement.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-868L (hardware)
- Affected version: 2.01b05
- Component: Authentication Handler,
/webfa_authentication.cgi - Affected CPE:
cpe:2.3:h:d-link:dir-868l:*:*:*:*:*:*:*:*
Patch Status
No patch, fixed version, or vendor advisory is referenced in the supplied NVD record. The CVE was published 2026-09-20 with a vulnerability status of Received, meaning NVD analysis is not yet complete. This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time.
Note that the DIR-868L is a legacy consumer router; operators should confirm support status directly with D-Link.