D-Link DIR-868L Firmware 2.01b05 Has Critical Remote Command Injection Flaw

D-Link DIR-868L routers running firmware version 2.01b05 contain a critical vulnerability that allows remote attackers to execute operating system commands. The flaw, identified as CVE-2026-110536, resides in the HNAP CGI Handler component and impacts the system function of the /htdocs/cgibin file.

Attackers can exploit this weakness by manipulating the SOAPACTION argument. According to the National Vulnerability Database record, this manipulation leads to OS command injection. The vulnerability is rated as critical with a CVSS score of 10. It maps to CWE-78 and CWE-77 weaknesses in the Common Weakness Enumeration framework.

Technical Context

The HNAP CGI Handler processes requests on the affected D-Link device. The vulnerability allows an attacker to launch an exploit remotely. The National Vulnerability Database notes that the exploit has been publicly disclosed and may be utilized by threat actors. The source material states that the exploit may be utilized, indicating potential for active abuse.

The specific attack vector involves injecting commands through the SOAPACTION argument. This argument is part of the HTTP request processed by the CGI handler. The source material states that executing a manipulation of this argument can lead to OS command injection. No further technical details on the sanitization failure are provided in the record.

Affected Systems

Only D-Link DIR-868L devices running firmware version 2.01b05 are listed as affected by this vulnerability. The National Vulnerability Database record specifies this exact version number. Users of other D-Link models or different firmware versions are not explicitly mentioned in the source material. Administrators should verify their current firmware version to determine if their devices are at risk.

The DIR-868L is a wireless router model from D-Link. The vulnerability impacts the web interface component responsible for handling CGI requests. Because the exploit can be launched remotely, any device exposed to the internet or local network could be targeted. There is no mention of other hardware or software components being impacted by this specific CVE.

What should you do?

No official patch or firmware update has been confirmed by D-Link or the National Vulnerability Database as of the time of this reporting. Security professionals should monitor vendor communications for an official fix. Until a patch is available, network segmentation and strict firewall rules can reduce exposure. Disabling remote access to the router’s web interface may also mitigate the risk of exploitation.