{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3hdlinkdir-868l2.01b05/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:dlink:dir-868l:2.01b05:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-110536"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DIR-868L (2.01b05)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["D-Link"],"content_html":"\u003cp\u003eA critical security vulnerability, tracked as CVE-2026-110536, has been identified in the D-Link DIR-868L router, specifically within firmware version 2.01b05. The flaw resides in the HNAP (Home Network Administration Protocol) CGI handler, specifically within the /htdocs/cgibin file. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request with a manipulated SOAPACTION argument. Because the application fails to properly sanitize this input before passing it to the underlying system shell, it results in arbitrary OS command execution with the privileges of the web server process. This vulnerability is of high concern due to the ease of remote exploitation and the potential for complete device compromise. The exploit details have been publicly disclosed, increasing the risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants an attacker the ability to execute arbitrary system commands on the affected router. This can lead to full device takeover, persistent backdoor installation, redirection of network traffic, or further internal reconnaissance within the victim's network. Given that this is a router-level vulnerability, it exposes all connected devices to the compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately verify the firmware version of all D-Link DIR-868L units in the environment.\u003c/li\u003e\n\u003cli\u003eIf the device is running version 2.01b05, upgrade to a patched firmware version if available from the vendor, or retire the device if it has reached end-of-life status.\u003c/li\u003e\n\u003cli\u003eRestrict access to the router's web management interface to trusted internal IP addresses only.\u003c/li\u003e\n\u003cli\u003eEnsure that HNAP and remote management features are disabled if not strictly required for business operations.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-14T20:32:56Z","date_published":"2026-10-14T20:32:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dlink-cve-2026-110536/","summary":"An unauthenticated remote OS command injection vulnerability in the HNAP CGI handler of D-Link DIR-868L firmware version 2.01b05 allows attackers to execute arbitrary system commands via the SOAPACTION header.","title":"OS Command Injection in D-Link DIR-868L","url":"https://feed.craftedsignal.io/briefs/2026-10-dlink-cve-2026-110536/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:h:dlink:dir-868l:2.01b05:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}