CVE-2026-4182

D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow

CVSS 9.3 CRITICALEPSS 1.1%CWE-119 CWE-121

Vexday Risk Score

48Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 9.3EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Ciclo de vida

15 mar 2026Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Productos afectados

D-Link · DIR-816

PoCs públicas encontradas — 1

cve_referencegithub.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_86/86.mdno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_86/86.md https://vuldb.com/?ctiid.351086 https://vuldb.com/?id.351086 https://vuldb.com/?submit.769830 https://www.dlink.com/