CVE-2026-52356: Command Injection

Published Oct 23, 2026

Updated

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.

Affected Software

1 affected component

D-Link DAP-1160L=A1_FW101WWb04

Event History

Oct 23, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What component is affected?

The affected endpoint is /htdocs/web/diagnostic.php on D-Link DAP-1160L devices running A1_FW101WWb04.

What does an attacker need to exploit this issue?

The vulnerability is exploited by supplying arbitrary shell metacharacters to the diagnostic.php endpoint. The provided data does not state whether authentication, local network access, or other preconditions are required.

How can I determine whether a device may be affected?

Check whether the device is a D-Link DAP-1160L and whether it is running firmware A1_FW101WWb04. Devices matching both details should be treated as potentially affected.

CVE-2026-52356: Command Injection

Affected Software

Event History

Frequently Asked Questions

What component is affected?

What does an attacker need to exploit this issue?

How can I determine whether a device may be affected?

Company

Resources

Contact

Frequently Asked Questions

What component is affected?

What does an attacker need to exploit this issue?

How can I determine whether a device may be affected?