---
title: Hunt: DIR-868L HNAP SOAPACTION pre-auth RCE (CVE-2026-110536) and internet-exposed management | ctxsec
url: https://ctxsec.com/items/hunt-dlink-hnap-dir868l
description: ""
status: "hunt idea (from public advisory/PoC)"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-dlink-hnap-dir868l.md)

hunt idea (from public advisory/PoC)

2026-10-15

### Hunt: DIR-868L HNAP SOAPACTION pre-auth RCE (CVE-2026-110536) and internet-exposed management

Inventory remaining D-Link DIR-868L (and similar CoBos-era) units; prefer asset tags/firmware banners over hostname alone. Alert on inbound HTTP(S) to port 80/443 with path /HNAP1/ and SOAPACTION headers containing GetDeviceSettings plus shell metacharacters (semicolon, backtick, dollar-paren, pipe). On the LAN, look for unexpected root shell children of the web CGI and NVRAM/config changes from non-admin stations. Because the product is EOL with a public PoC, treat any WAN-reachable management UI as compromise-likely until replaced.

```
# rough hunt idea
# HTTP /HNAP1/ + SOAPACTION containing GetDeviceSettings and shell metacharacters
# correlate with unexpected uid=0 children of cgibin / httpd
```

Sources: [Walnut1337 advisory](https://github.com/Walnut1337/Command-Injection-DIR-868L/blob/main/ADVISORY.md) · [CVE-2026-110536](https://www.cve.org/CVERecord?id=CVE-2026-110536)