CVE-2026-5844: D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection
A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. The manipulation of the argument IPAddress results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5844?
CVE-2026-5844 has been classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-5844?
To fix CVE-2026-5844, update your D-Link DIR-882 firmware to the latest version provided by D-Link.
What components are affected by CVE-2026-5844?
CVE-2026-5844 specifically affects the HNAP1 SetNetworkSettings Handler in the D-Link DIR-882 router.
What is the impact of CVE-2026-5844?
The impact of CVE-2026-5844 includes the possibility of arbitrary OS command execution through crafted IPAddress inputs.
Which versions of D-Link DIR-882 are impacted by CVE-2026-5844?
D-Link DIR-882 version 1.01B02 is specifically impacted by CVE-2026-5844.