D-Link — CraftedSignal Threat Feed

D-Link DI-8100 Remote Buffer Overflow Vulnerability

hello@craftedsignal.io — Tue, 28 Apr 2026 09:16:18 +0000

A critical buffer overflow vulnerability, identified as CVE-2026-7248, affects the D-Link DI-8100 router, specifically version 16.07.26A1. The vulnerability resides within the tgfile_htm function of the tgfile.htm file, a component of the CGI endpoint. By crafting a malicious request targeting the fn argument, a remote, unauthenticated attacker can trigger a buffer overflow, potentially leading to arbitrary code execution. This vulnerability is particularly concerning as a proof-of-concept exploit has been publicly released, increasing the likelihood of exploitation. Routers are often targeted due to their exposure to the internet and the potential to compromise entire networks.

Attack Chain

The attacker identifies a vulnerable D-Link DI-8100 router running firmware version 16.07.26A1.
The attacker crafts a malicious HTTP request targeting the tgfile.htm CGI endpoint.
The malicious request includes an overly long string in the fn argument.
The router’s web server processes the request and passes the fn argument to the tgfile_htm function.
The tgfile_htm function fails to properly validate the length of the fn argument.
A buffer overflow occurs when the overly long fn argument is copied into a fixed-size buffer.
The buffer overflow overwrites adjacent memory, potentially including return addresses or other critical data.
The attacker gains arbitrary code execution on the router, potentially allowing them to take full control of the device.

Impact

Successful exploitation of this vulnerability allows an attacker to remotely execute arbitrary code on the D-Link DI-8100 router. This could lead to a complete compromise of the device, allowing the attacker to intercept network traffic, modify router settings, or use the router as a launchpad for further attacks against other devices on the network. Given the public availability of an exploit, widespread exploitation is possible, potentially affecting numerous home and small business networks.

Recommendation

Monitor web server logs for abnormally long fn parameters in requests to /tgfile.htm using the provided Sigma rule to detect potential exploitation attempts.
Implement rate limiting on HTTP requests to the router’s web interface to mitigate brute-force exploitation attempts.
Since the source material only identifies a vulnerability, without a patch, consider replacing the affected device.

D-Link DIR-605L Router Buffer Overflow Vulnerability (CVE-2026-5980)

hello@craftedsignal.io — Thu, 09 Apr 2026 21:16:14 +0000

CVE-2026-5980 is a critical buffer overflow vulnerability affecting the D-Link DIR-605L router, specifically version 2.13B01. The vulnerability resides in the formSetMACFilter function within the /goform/formSetMACFilter component’s POST Request Handler. A remote attacker can exploit this by sending a crafted POST request with a malicious curTime argument, leading to a buffer overflow. Exploit code is publicly available. Due to the product’s end-of-life status, no patch is available, making unpatched devices highly vulnerable. This allows for potential remote code execution and complete compromise of the device.

Attack Chain

The attacker identifies a vulnerable D-Link DIR-605L router (version 2.13B01) exposed to the internet.
The attacker crafts a malicious POST request targeting the /goform/formSetMACFilter endpoint.
Within the POST request, the attacker includes the curTime parameter, injecting a string exceeding the buffer’s expected size.
The router’s formSetMACFilter function processes the POST request without proper bounds checking on the curTime argument.
The oversized curTime string overflows the buffer, overwriting adjacent memory regions.
The attacker carefully crafts the overflow to overwrite critical data, such as return addresses or function pointers.
When the formSetMACFilter function attempts to return, the overwritten return address is used, redirecting execution to attacker-controlled code.
The attacker gains arbitrary code execution on the router, potentially installing malware, changing configurations, or using the device for further malicious activities.

Impact

Successful exploitation of CVE-2026-5980 allows a remote attacker to gain complete control over the vulnerable D-Link DIR-605L router. Given that the affected product is no longer supported, a large number of legacy routers remain vulnerable. Attackers can leverage compromised routers to establish botnets, conduct man-in-the-middle attacks, or gain unauthorized access to internal networks connected to the router. The lack of patches elevates the severity, as affected users have no direct mitigation available other than replacing the device.

Recommendation

Deploy the Sigma rule Detect D-Link DIR-605L Buffer Overflow Attempt to identify malicious POST requests targeting the /goform/formSetMACFilter endpoint on D-Link DIR-605L devices.
Implement network segmentation to isolate potentially vulnerable D-Link DIR-605L routers to limit the impact of a successful compromise.
If possible, replace D-Link DIR-605L routers (version 2.13B01) with newer, supported devices to eliminate the vulnerability.

D-Link DIR-882 Remote Command Injection Vulnerability (CVE-2026-5844)

hello@craftedsignal.io — Thu, 09 Apr 2026 05:16:06 +0000

CVE-2026-5844 describes a critical command injection vulnerability affecting D-Link DIR-882 routers running firmware version 1.01B02. The vulnerability resides in the sprintf function within the prog.cgi script, specifically within the HNAP1 SetNetworkSettings Handler. A remote, unauthenticated attacker can exploit this flaw by manipulating the IPAddress argument, injecting arbitrary OS commands that are then executed with elevated privileges. The vulnerability is considered critical due to the potential for complete system compromise and the availability of a public exploit. This vulnerability impacts products that are no longer supported by the maintainer, increasing the risk for users who have not migrated to newer devices.

Attack Chain

The attacker identifies a vulnerable D-Link DIR-882 router running firmware version 1.01B02.
The attacker sends a crafted HTTP request to the prog.cgi endpoint.
The HTTP request targets the HNAP1 SetNetworkSettings Handler.
The attacker manipulates the IPAddress argument within the HTTP request, injecting malicious OS commands.
The sprintf function in prog.cgi processes the attacker-controlled IPAddress argument without proper sanitization.
The injected OS commands are executed on the router’s operating system due to the command injection vulnerability in sprintf.
The attacker gains remote code execution on the router.
The attacker can then perform actions such as modifying router settings, eavesdropping on network traffic, or using the router as a botnet node.

Impact

Successful exploitation of CVE-2026-5844 allows a remote attacker to execute arbitrary OS commands on the vulnerable D-Link DIR-882 router. This can lead to a complete compromise of the device, enabling attackers to reconfigure the router, intercept network traffic, or use the compromised device as part of a botnet. The vulnerability affects end-of-life products, meaning no official patches are available. The impact is significant due to the widespread use of these routers in home and small business networks, where they can act as a gateway to internal systems.

Recommendation

Deploy the Sigma rule Detect D-Link DIR-882 Command Injection Attempt to detect suspicious requests to prog.cgi containing shell metacharacters.
Block access to the URL https://files.catbox.moe/ei31k1.zip to prevent the download of the publicly available exploit (IOC).
Monitor web server logs for HTTP requests to prog.cgi with unusually long IPAddress parameters (log source: webserver).
Implement network intrusion detection systems (IDS) rules to identify and block exploit attempts targeting CVE-2026-5844 (log source: network_connection).

D-LINK Router M60 and DIR-3040 'Airsnitch' Vulnerability

hello@craftedsignal.io — Wed, 08 Apr 2026 09:58:56 +0000

The ‘Airsnitch’ vulnerability affects D-LINK Router models M60 and DIR-3040. An attacker positioned within an adjacent network can exploit this flaw to circumvent security protocols. This access allows the attacker to potentially expose sensitive data and manipulate network traffic. The specifics of the vulnerability exploitation are not detailed in this advisory, but the impact suggests a significant compromise of network security and data integrity. Defenders should prioritize identifying and mitigating this vulnerability to prevent unauthorized access and data breaches. This vulnerability poses a risk to both home and enterprise networks utilizing the affected D-LINK router models.

Attack Chain

Attacker gains access to an adjacent network, either physically or via compromised wireless access.
Attacker sends crafted network packets targeting the D-LINK router’s management interface.
The ‘Airsnitch’ vulnerability is exploited, bypassing authentication or authorization checks.
Attacker gains unauthorized access to the router’s configuration settings.
Attacker modifies DNS settings to redirect traffic to malicious servers.
Attacker intercepts and analyzes network traffic, capturing sensitive information like usernames and passwords.
Attacker injects malicious code into network traffic, potentially compromising other devices on the network.
Attacker maintains persistent access by creating a rogue administrator account or installing malicious firmware.

Impact

Successful exploitation of the ‘Airsnitch’ vulnerability can lead to significant compromise of network security. Attackers can gain unauthorized access to sensitive information, manipulate network traffic, and potentially compromise other devices on the network. This can result in data breaches, financial losses, and reputational damage. The number of potential victims is significant, given the widespread use of D-LINK routers in both home and enterprise environments.

Recommendation

Analyze network traffic for suspicious patterns indicative of unauthorized access attempts to the D-LINK router’s management interface to facilitate tuning of existing firewall rules and creation of new rules.
Monitor DNS settings on D-LINK routers for unauthorized modifications using network monitoring tools.
Implement strict access control policies on the adjacent network to limit the attacker’s ability to reach the D-LINK routers.

D-Link DIR-825 Buffer Overflow Vulnerability in miniupnpd

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

A buffer overflow vulnerability, identified as CVE-2026-7069, has been discovered in D-Link DIR-825 routers with firmware versions up to 3.00b32. The vulnerability resides within the AddPortMapping function of the upnpsoap.c file, part of the miniupnpd component. An attacker on the local network can exploit this vulnerability by manipulating the NewPortMappingDescription argument, leading to a buffer overflow. Given that the exploit is publicly available, the risk of exploitation is elevated. This vulnerability is especially critical as it affects end-of-life products, meaning that official patches are unlikely to be released.

Attack Chain

Attacker gains access to the local network, either through physical access or compromising a device on the network.
The attacker identifies a vulnerable D-Link DIR-825 router running a firmware version up to 3.00b32.
The attacker crafts a malicious SOAP request targeting the UPnP service on the router.
The crafted request includes a NewPortMappingDescription argument with a payload exceeding the buffer’s capacity in the AddPortMapping function within upnpsoap.c.
The router’s miniupnpd component processes the SOAP request, triggering the buffer overflow when writing the overly long NewPortMappingDescription.
The buffer overflow overwrites adjacent memory locations, potentially including critical function pointers or return addresses.
The attacker redirects execution flow to malicious code injected into the overflowed buffer.
The attacker executes arbitrary code on the router, potentially gaining full control of the device or using it as a pivot point to attack other devices on the network.

Impact

Successful exploitation of CVE-2026-7069 allows an attacker on the local network to execute arbitrary code on the vulnerable D-Link DIR-825 router. This can lead to complete compromise of the router, allowing the attacker to eavesdrop on network traffic, modify DNS settings, or use the router to launch attacks against other devices within the network or on the internet. Given the end-of-life status of the affected devices, a large number of potentially vulnerable routers may remain in use, making this a significant threat.

Recommendation

Disable UPnP on D-Link DIR-825 routers where possible to prevent exploitation of CVE-2026-7069.
Monitor network traffic for suspicious SOAP requests targeting the UPnP service (miniupnpd) on internal network devices using a network intrusion detection system (NIDS). Deploy the Sigma rule targeting HTTP POST requests to the UPnP service.
Segment networks to limit the impact of a compromised router in case of successful exploitation.