PT-2026-39870 · D Link · Dir-816

Stksgg · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-8346

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-816 version 1.10CNB05 R1B011D88210

Description A remote command injection issue exists in the portForward() function. By manipulating the ip address argument, an attacker can execute arbitrary commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the portForward() function to minimize the risk of exploitation.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-8346

Affected Products

Dir-816

References · 9

• 🔥 https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8346 · Security Note
• https://t.me/cveNotify/163149 · Telegram Post
• https://t.me/CVEtracker/53438 · Telegram Post
• https://vuldb.com/vuln/362662/cti · Note
• https://vuldb.com/submit/811380 · Note
• https://twitter.com/CVEarity/status/2054083945579659612 · Twitter Post
• https://vuldb.com/vuln/362662 · Note
• https://dlink.com · Note