CVE-2026-5844 D-Link CVE debrief

Who should care

Defenders responsible for D-Link DIR-882 devices with firmware version 1.01B02 should assess exposure and prioritize verification and potential remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify if affected devices are still in use, check for compensating controls, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-5844 is a HIGH-severity vulnerability in D-Link DIR-882 devices with firmware version 1.01B02, allowing remote OS command injection. Defenders should prioritize verifying exposure, assessing potential impact, and considering remediation.

• Remote attackers may be able to inject OS commands on affected devices
• Defenders need to verify exposure and assess potential impact
• Remediation may require upgrading to a supported firmware version
• Exposure verification and potential remediation are prioritized due to the HIGH CVSS score

Technical summary

The vulnerability is caused by improper sanitization of user input in the IPAddress argument of the HNAP1 SetNetworkSettings Handler in prog.cgi. This allows remote attackers to inject OS commands. The affected product, D-Link DIR-882 with firmware version 1.01B02, is no longer supported by the maintainer. Defenders should prioritize verifying exposure, assessing potential impact, and considering remediation. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product information.

Defensive priority

Defenders should prioritize verifying exposure of D-Link DIR-882 devices with firmware version 1.01B02, assessing if they are still in use, and checking for any compensating controls.

Recommended defensive actions

• Verify exposure of D-Link DIR-882 devices with firmware version 1.01B02
• Assess if affected devices are still in use and check for compensating controls
• Monitor for potential exploitation attempts
• Consider upgrading to a supported firmware version if available
• Review vendor guidance for D-Link DIR-882 devices
• Perform asset inventory of D-Link DIR-882 devices
• Check for rollback/change windows for remediation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product information. However, the corpus does not establish versions beyond 1.01B02, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.