The flaw resides in the SSDP Service function sub_1BF84 of the D‑Link DIR‑868L firmware 110b03, allowing an attacker to manipulate the ST argument and inject arbitrary operating‑system commands. This results in full remote code execution, giving the attacker control over the device’s operating system. The vulnerability is documented as an OS command injection with both CWE-77 and CWE-78 references.

The vulnerability affects only the D‑Link DIR‑868L model running firmware version 110b03, which is no longer supported by the manufacturer. No other devices or firmware variants are listed as impacted.

The CVSS score of 9.3 indicates critical severity, yet the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate likelihood of widespread exploitation at present. The attack vector is remote; the SSDP service listens for network traffic and can be reached from outside the local network, making it possible for an off‑network attacker to trigger the injection. Exploit code has been published and may be used.