CVE-2026-110536 (CVSS 3.1 10.0 / CVSS 4.0 ~9.3) is an unauthenticated OS command injection in the HNAP CGI handler of D-Link DIR-868L hardware rev B1 firmware 2.01b05. An unanchored strstr() on the SOAPACTION header lets any request containing GetDeviceSettings skip HNAP_AUTH, then the action name after the last slash is concatenated into a system() call as root, with command output returned in the HTTP response. Researcher Walnut1337 published a full advisory and PoC on GitHub (VulDB submission 2026-09-28; CVE assigned thereafter). The product is end-of-life / end-of-support (D-Link SAP10189), so there is no vendor patch—replace the hardware. Until then, do not expose the web/HNAP interface to the internet; restrict management to trusted LAN hosts. Not on CISA KEV as of catalogVersion 2026.10.14.