rootpwn

critical · CVSS v3 10 · CVSS v4 10

CVE-2026-94089

A critical stack-based buffer overflow exists in D-Link DIR-868L firmware 2.01b05 within the Authentication Handler CGI. Remote attackers ca

Overview

A critical stack-based buffer overflow exists in D-Link DIR-868L firmware 2.01b05 within the Authentication Handler CGI. Remote attackers can trigger the overflow by sending crafted id/password parameters, potentially gaining arbitrary code execution. The vulnerability is publicly disclosed and can be exploited without authentication.

Description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Impact

The flaw compromises confidentiality, integrity, and availability of the affected device. Attackers could execute arbitrary code, take control of the router, intercept or modify traffic, and disrupt network services. Network administrators and users of the affected firmware are at risk.

Remediation

Apply the official firmware update released by D-Link that patches the strcpy buffer overflow in /webfa_authentication.cgi. If an update is unavailable, disable remote web management or block access to the router’s web interface from external networks. Monitor logs for anomalous authentication attempts and enforce strong passwords.

Risk context

Severity is critical with a CVSS v3 score of 10.0. No EPSS data is available, but the vulnerability is publicly disclosed and exploitable remotely, indicating high urgency for patching.

Affected products

  • D-Link DIR-868L 2.01b05

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
10
EPSS
—

buffer-overflow remote-exploit router authentication critical D-Link firmware web-interface

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94095

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94096

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94097

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis