PT-2026-31585 · D Link · Dir-882

Meshaal · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-5844

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-882 version 1.01B02

Description A flaw exists in the sprintf function within the prog.cgi file of the HNAP1 SetNetworkSettings Handler component. Manipulation of the IPAddress argument can lead to operating system command injection. This issue is remotely exploitable and affects a product no longer supported by the maintainer.

Recommendations Update to a newer version if available. As a temporary workaround, consider disabling the HNAP1 SetNetworkSettings Handler component until a patch is available.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2026-05156

CVE-2026-5844

Affected Products

Dir-882

References · 11

• 🔥 https://files.catbox.moe/ei31k1.zip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5844 · Security Note
• https://bdu.fstec.ru/vul/2026-05156 · Security Note
• https://twitter.com/CVEarity/status/2042532697629917254 · Twitter Post
• https://vuldb.com/vuln/356329 · Note
• https://dlink.com · Note
• https://twitter.com/VulmonFeeds/status/2042208443855958296 · Twitter Post
• https://vuldb.com/submit/790290 · Note
• https://twitter.com/ptdbugs/status/2042255837796749668 · Twitter Post
• https://github.com/advisories/GHSA-2723-wm97-82qm · Note
• https://vuldb.com/vuln/356329/cti · Note