---
title: D-Link DIR-868L CVE-2026-110536: pre-auth HNAP SOAPACTION command injection as root; public PoC, EOL device | ctxsec
url: https://ctxsec.com/items/dlink-dir868l-cve-2026-110536
description: ""
status: "confirmed (CVE + public PoC); not on CISA KEV"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/dlink-dir868l-cve-2026-110536.md)

confirmed (CVE + public PoC); not on CISA KEV

2026-10-14

### D-Link DIR-868L CVE-2026-110536: pre-auth HNAP SOAPACTION command injection as root; public PoC, EOL device

CVE-2026-110536 (CVSS 3.1 10.0 / CVSS 4.0 ~9.3) is an unauthenticated OS command injection in the HNAP CGI handler of D-Link DIR-868L hardware rev B1 firmware 2.01b05. An unanchored strstr() on the SOAPACTION header lets any request containing GetDeviceSettings skip HNAP_AUTH, then the action name after the last slash is concatenated into a system() call as root, with command output returned in the HTTP response. Researcher Walnut1337 published a full advisory and PoC on GitHub (VulDB submission 2026-09-28; CVE assigned thereafter). The product is end-of-life / end-of-support (D-Link SAP10189), so there is no vendor patch—replace the hardware. Until then, do not expose the web/HNAP interface to the internet; restrict management to trusted LAN hosts. Not on CISA KEV as of catalogVersion 2026.10.14.

Sources: [CVE-2026-110536](https://www.cve.org/CVERecord?id=CVE-2026-110536) · [Walnut1337 advisory](https://github.com/Walnut1337/Command-Injection-DIR-868L/blob/main/ADVISORY.md) · [PoC tree](https://github.com/Walnut1337/Command-Injection-DIR-868L)