CVE-2026-4181

8.9 highEPSS 1.2%

A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-119, CWE-121
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dlink:dir-816_firmware

References

https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_85/85.md
https://vuldb.com/?ctiid.351085
https://vuldb.com/?id.351085
https://vuldb.com/?submit.769829
https://www.dlink.com/

Check your stack JSON