A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file /authentication.cgi. Performing manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.9 · dlinkNVD modified 2026-10-18 20:10
Affected (CPE criteria) 1
cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*
References 6
- https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(authentication.cgi).pdf Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.332476 Permissions Required, VDB Entry
- https://vuldb.com/?id.332476 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.685538 Third Party Advisory, VDB Entry
- https://www.dlink.com/ Product
- https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(authentication.cgi).pdf Exploit, Third Party Advisory