CVE-2026-5844

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkSettings Handler. The manipulation of the argument IPAddress results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-584406.8Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (CVE-2026-584416.3SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLCVE-2026-584426.5Repository migration SSRF via multi-answer DNS allow-list bypassCVE-2026-584439.1Public-only repository tokens can update private PR head branchesCVE-2026-584444.3Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsCVE-2026-584452.7Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APICVE-2026-584466.5Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/ACVE-2026-584476.5Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticateCVE-2026-584486.5yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbCVE-2026-584499.8txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.utilCVE-2026-58459.6An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticaCVE-2026-584504.3Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to re