CVE-2026-4182
A weakness has been identified in D-Link DIR-816 1.10CNB05.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
- CVSS 4.0
- 8.9 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-121, CWE-787
- Affected
- dlink/dir-816 firmware
- Source
- cna@vuldb.com
References
- https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_86/86.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.351086Permissions Required, VDB Entry
- https://vuldb.com/?id.351086Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.769830Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.