CVE-2026-3485

Katalog CVE

CVSS 9.8 · Critical EPSS 6,7%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada dlink dir-868l firmware. Skor CVSS 3.1 9.8 (Critical) menurut vuldb.com.

Deskripsi (NVD)

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Rincian

Terbit di NVD

3 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

6,7% peluang dieksploitasi; lebih tinggi dari 93,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kn0sinna.notion.site/dlink-dir-868l-ssdp-command-injection-30eb1876cd6e80caa691de6fe5cab59c exploit · advisory pihak ketiga
• https://vuldb.com/?id.348560 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.764759 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.348560 permissions required · vdb entry
• https://www.dlink.com/ product