An OS command injection flaw exists in the diagnostic.php page of the D-Link DAP1160L A1 firmware version FW101WWb04. By inserting shell metacharacters into user‑supplied input, an attacker can trigger the device to execute arbitrary operating‑system commands, potentially gaining full control over the unit.

D-Link DAP1160L A1 firmware version FW101WWb04 is affected. No additional vendor or product information is provided in the advisory.

The CVSS score of 8.8 indicates a high severity level. The vulnerability can be triggered via the web interface exposed to a network. The advisory does not specify whether authentication or local privileges are required, and the EPSS score of 1% indicates a low but non‑zero probability of exploitation; the vulnerability is not listed in the KEV catalog. Command injection, if successful, could lead to remote code execution. Because key details about the attack vector and exploitation prevalence are lacking, the exact risk level remains uncertain but could be high if the endpoint is reachable.