High severity · published Apr 26, 2026
CVE-2026-7067
D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection
7.3
CVSS
2.7%
EPSS
No
On KEV
Description
A vulnerability was determined in D-Link DIR-822 A_101. The impacted element is the function system of the file /udhcpcd/dhcpd.c of the component udhcpd DHCP Service. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DIR-822 · D-Link
A_101 · source: vendor
DF
Dir-822 Firmware · Dlink
1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7067
Exploit
https://tzh00203.notion.site/D-Link-DIR-822-A1-Command-Injection-in-udhcpd-via-DHCP-Hostname-337b5c52018a80d9b638d0fa59969e6b
Third Party Advisory
https://vuldb.com/submit/798645
Third Party Advisory
https://vuldb.com/vuln/359642
Permissions Required
https://vuldb.com/vuln/359642/cti
Product
https://www.dlink.com/