Critical severity · published Mar 3, 2026
CVE-2026-3485
A flaw has been found in D-Link DIR-868L 110b03
9.8
CVSS
4.8%
EPSS
No
On KEV
Description
A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-868l Firmware · Dlink
110b03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3485
Exploit
https://kn0sinna.notion.site/dlink-dir-868l-ssdp-command-injection-30eb1876cd6e80caa691de6fe5cab59c
Permissions Required
https://vuldb.com/?ctiid.348560
Third Party Advisory
https://vuldb.com/?id.348560
Third Party Advisory
https://vuldb.com/?submit.764759
Product
https://www.dlink.com/
More from Dir-868l Firmware
9.8
CVE-2019-17621
D-Link DIR-859 Router Command Execution Vulnerability
9.8
CVE-2018-6530
D-Link Multiple Routers OS Command Injection Vulnerability
9.8
CVE-2025-55583
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component
9.8
CVE-2023-39668
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the inet_ntoa() function
9.8
CVE-2023-39667
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the FUN_0000acb4 function