Description
A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-03-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the ssdpcgi_main function of the SSDP component in D-Link DIR-820LW firmware 2.03, allowing a remote attacker to inject operating system commands by manipulating the HTTP_ST environment variable. This command injection can be triggered over the network and gives control to execute arbitrary commands on the router, potentially compromising confidentiality, integrity, and availability of the network.

Affected Systems

All D-Link DIR-820LW routers running firmware version 2.03 are affected. Devices with this firmware deployed on any network present a risk to administrators and users.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of 1% suggests a relatively low but measurable likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the exposed SSDP functionality remotely through crafted HTTP requests that set the HTTP_ST environment variable, enabling command injection without prior authentication.

Generated by OpenCVE AI on April 3, 2026 at 22:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware upgrade released by D-Link that addresses the SSDP command injection flaw.
  • If a patch is not yet available, restrict external access to the router by disabling SSDP or blocking its UDP ports from outside networks.
  • Review router logs regularly for signs of unauthorized command execution and investigate any suspicious activity.
  • Consider network segmentation or firewall rules to isolate the router from untrusted traffic until a patch is applied.

Generated by OpenCVE AI on April 3, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-820lw
Dlink dir-820lw Firmware
CPEs cpe:2.3:h:dlink:dir-820lw:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-820lw_firmware:2.03:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-820lw
Dlink dir-820lw Firmware

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dir-820lw
Vendors & Products D-link
D-link dir-820lw

Fri, 20 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Mar 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Title D-Link DIR-820LW SSDP ssdpcgi_main os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dir-820lw
Dlink Dir-820lw Dir-820lw Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-20T19:55:44.639Z

Reserved: 2026-03-20T12:21:12.110Z

Link: CVE-2026-4499

cve-icon Vulnrichment

Updated: 2026-03-20T19:55:39.829Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-20T20:16:50.207

Modified: 2026-04-03T19:32:11.710

Link: CVE-2026-4499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-07T08:09:02Z

Weaknesses