High severity · published Jun 8, 2026
CVE-2026-11555
D-Link DGS-1100-08PD Web boa.conf least privilege violation
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Interface. Such manipulation leads to least privilege violation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
DGS-1100-08PD · D-Link
1.00.006 · source: vendor
DF
Dgs-1100-08pd Firmware · Dlink
1.00.006 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11555
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11555
Third Party Advisory
https://vuldb.com/cve/CVE-2026-11555
Third Party Advisory
https://vuldb.com/submit/834824
Third Party Advisory
https://vuldb.com/vuln/369165
Permissions Required
https://vuldb.com/vuln/369165/cti
Product
https://www.dlink.com/
Vendor Advisory
https://www.notion.so/D-link-DGS-1100-08PD-v1-00-006-3670ed14e5cb80848bc4e3129dfafa29?source=copy_link