PT-2026-35274 · D Link · Dir-822

Tian · Published 2026-04-26 · Updated 2026-05-23 · CVE-2026-7067

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DIR-822 A 101

Description A command injection issue exists in the udhcpd DHCP Service within the system() function of the /udhcpcd/dhcpd.c file. A remote attacker can exploit this by manipulating the Hostname argument to execute arbitrary code. This issue occurs because the software fails to neutralize special elements within the input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-74

CWE-77

Related Identifiers

BDU:2026-05909

CVE-2026-7067

Affected Products

Dir-822

References · 12

• 🔥 https://tzh00203.notion.site/D-Link-DIR-822-A1-Command-Injection-in-udhcpd-via-DHCP-Hostname-337b5c52018a80d9b638d0fa59969e6b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7067 · Security Note
• https://bdu.fstec.ru/vul/2026-05909 · Security Note
• https://twitter.com/CVEarity/status/2048707705154723877 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2049664334335205586 · Twitter Post
• https://dlink.com · Note
• https://vuldb.com/submit/798645 · Note
• https://twitter.com/lyrie_ai/status/2058058127061241867 · Twitter Post
• https://vuldb.com/vuln/359642 · Note
• https://vuldb.com/vuln/359642/cti · Note
• https://twitter.com/lyrie_ai/status/2058058128785105001 · Twitter Post
• https://twitter.com/lyrie_ai/status/2058058127895851163 · Twitter Post