Description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-14T19:17:10.610Z",
  "pubdate": "2026-10-14T19:17:10.610Z",
  "executiveSummary": "The D-Link DIR-868L (version 2.01b05) is susceptible to an OS command injection vulnerability located within the HNAP CGI Handler.\nThis vulnerability originates from improper input validation within the system function of the /htdocs/cgibin file.\nAn unauthenticated, remote attacker can exploit this flaw by supplying a maliciously crafted SOAPACTION argument to the HNAP interface.\nSuccessful exploitation grants the attacker the ability to execute arbitrary operating system commands with the privileges of the affected service, potentially leading to full device compromise.\nGiven that the exploit has been publicly disclosed, the risk to exposed devices is critical, as it requires no prior authentication and can be initiated over the network.\nThis vulnerability highlights a lack of secure input sanitization for components interacting with system-level command execution processes.",
  "technicalDetails": "The vulnerability resides in the HNAP (Home Network Administration Protocol) CGI handler, specifically within the implementation of the system function contained in /htdocs/cgibin.\nThe root cause of this security flaw is an insufficient sanitization mechanism applied to the SOAPACTION argument before it is passed to a backend system function or command execution shell.\nIn the context of the D-Link DIR-868L firmware, the HNAP protocol utilizes SOAP actions to manage various administrative tasks. The application parses the SOAPACTION header or associated request body without adequately validating or escaping metacharacters that could be interpreted by a command shell (such as backticks, semicolons, or pipe operators).\nAn attacker initiates the attack flow by sending a crafted HTTP request to the device's web server. The request header, specifically the SOAPACTION field, contains a payload designed to break out of the intended functional parameters. Because the affected binary executes this unsanitized input directly via a system-level call, the operating system interprets the injected command string.\nFor example, an attacker could append command separators like ';' followed by arbitrary commands such as 'reboot', 'wget', or 'sh' scripts to fetch and execute further malicious binaries from a remote server.\nSince the HNAP interface is accessible over the network without the requirement of valid session tokens or prior administrative authentication, the attack surface is exposed to any remote actor capable of reaching the device's web interface.\nThe post-exploitation impact is severe; because the command injection occurs at the system level within the firmware's execution environment, an attacker gains the ability to execute commands with elevated privileges. This allows for persistent configuration changes, lateral movement within the local network, deployment of backdoors, or complete denial-of-service by executing destructive system commands.\nThis vulnerability underscores a failure in defensive coding practices where user-supplied input is directly concatenated into a system command string without being passed through robust argument validation or parameterization APIs."
}