PT-2026-7026 · D Link · Di-7100G

Jfkk · Published 2026-01-31 · Updated 2026-02-09 · CVE-2026-2193

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DI-7100G C1 version 24.04.18D1

Description A flaw exists in the set jhttpd info function that allows for command injection. Manipulating the usb username argument can lead to remote exploitation.

Recommendations Apply updates to address the issue in the set jhttpd info function. As a temporary workaround, restrict or disable the use of the usb username argument.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2026-02477

CVE-2026-2193

Affected Products

Di-7100G

References · 11

• 🔥 https://github.com/glkfc/IoT-Vulnerability/blob/main/D-Link/Dlink_4.md · Exploit
• https://bdu.fstec.ru/vul/2026-02477 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2193 · Security Note
• https://t.me/CVEtracker/44141 · Telegram Post
• https://vuldb.com/?id.344896 · Note
• https://dlink.com · Note
• https://twitter.com/CVEnew/status/2020640454652342453 · Twitter Post
• https://vuldb.com/?submit.749803 · Note
• https://vuldb.com/?ctiid.344896 · Note
• https://t.me/cveNotify/151337 · Telegram Post