CVE-2026-94089
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could exploit this vulnerability to cause a buffer overflow, potentially leading to arbitrary code execution or device crash, posing a serious threat to network security.
Recommendation
It is recommended to immediately update the D-Link DIR-868L router firmware to the latest available version if a patch is released. If not, consider disabling remote access to the administrative panel or restricting it to trusted IP addresses.
Other vulnerabilities in D-Link DIR-868L
See all- CVE-2026-110536Critical
A vulnerability was found in D-Link DIR-868L version 2.01b05. It affects the system function in the /htdocs/cgibin file of the HNAP CGI Handler component. Manipulation of the SOAPACTION argument can lead to OS command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2023-39668Critical
The D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow in the inet_ntoa() function via the param_2 parameter.
- CVE-2023-39667Critical
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow vulnerability in the FUN_0000acb4 function via the param_2 parameter.
- CVE-2023-39665Critical
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow via the acStack_50 parameter.
Original NVD description (English source)
A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS