CVE-2026-94089: D-Link DIR-868L Buffer Overflow
TL;DR - CVE-2026-94089 is a remotely reachable stack-based buffer overflow in the D-Link DIR-868L Authentication Handler. - Firmware 2.01b05 is affected; no vendor-confirmed fixed version was identified. - A public crash PoC is referenced. Active exploitation is not confirmed, but exposed devices should be isolated or replaced promptly.
CVE-2026-94089 affects D-Link DIR-868L firmware 2.01b05 through a reported remote stack-based buffer overflow in the /webfa_authentication.cgi endpoint. NVD reports a CVSS base score of 10.0 and references a public proof of concept. No vendor-confirmed fixed firmware version was identified in the available evidence.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-94089 |
| Product | D-Link DIR-868L |
| Affected firmware | 2.01b05 |
| CVSS base score | 10.0, according to NVD |
| CVSS vector | Not supplied in the available NVD response |
| Attack vector | Remote, according to the NVD description |
| Authentication required | Unknown; the available record does not establish this |
| Vulnerability type | Remote stack-based buffer overflow |
| Vulnerable component | Authentication Handler |
| Affected endpoint | /webfa_authentication.cgi |
| Patch available | No vendor-confirmed fixed version identified |
| Public PoC | Yes, an NVD-listed GitHub reference exists |
| CISA KEV status | Not listed |
CVE-2026-94089 should be treated as a high-priority network-device vulnerability because it combines a reported maximum CVSS score with remote reachability and public exploit disclosure. The available evidence does not establish that every DIR-868L firmware release is affected. It specifically identifies firmware version 2.01b05.
The absence of a confirmed patch is material. Administrators should not assume that a later firmware version fixes the issue unless D-Link documentation or testing confirms it. Where the device is exposed to an untrusted network and no supported update is available, isolation or replacement is the safer remediation.
What Is This Vulnerability?
The reported root cause is an unsafe call to the C standard library function strcpy in the DIR-868L authentication-processing path. strcpy copies data until a null terminator is encountered and does not enforce the size of the destination buffer. If attacker-controlled input exceeds that buffer, adjacent stack memory can be overwritten.
The affected request parameters are reported as id and password. The vulnerable handler is:
/webfa_authentication.cgi
Manipulating either parameter may therefore trigger a stack-based buffer overflow. Depending on the device’s memory protections, input handling, and exploit reliability, consequences could include a process crash, router instability, denial of service, or potentially code execution. The supplied records do not establish reliable remote code execution, the exact overwrite layout, or the security controls present in the affected firmware.
The vulnerability is described as remotely executable. That does not by itself prove that the endpoint is exposed on the public internet. Exposure depends on the router’s management configuration, WAN administration settings, access-control rules, upstream filtering, and whether the endpoint can be reached from a client network or adjacent segment.
Who Is Affected?
The affected product and version identified by the available NVD data are:
| Product | Affected version | Scope of evidence |
|---|---|---|
| D-Link DIR-868L | Firmware 2.01b05 | Specifically identified by the available CVE record |
No broader affected-version range was provided. Earlier and later DIR-868L firmware versions cannot be classified from the supplied evidence. Administrators should verify the exact firmware version on each device rather than assuming that all DIR-868L units, or all versions other than 2.01b05, are vulnerable.
The highest-risk installations are routers with remote administration enabled, devices reachable from an internet-facing management network, and units deployed on networks where untrusted users can interact with the management interface. Even when WAN administration is disabled, an attacker who gains access to a local, guest, wireless, or adjacent network may still be able to target reachable management services.
CVSS Score Breakdown
NVD reports a CVSS base score of 10.0 for CVE-2026-94089. However, the available NVD response did not include a CVSS vector string. Without that vector, the individual metric values cannot be reliably reconstructed.
The evidence supports a remote attack surface, but it does not establish all of the following metrics:
- Whether authentication is required
- Whether exploitation requires user interaction
- Whether the vulnerable service is exposed over a network beyond the local or adjacent network
- The confidentiality, integrity, and availability impacts
- Whether the reported score uses CVSS 3.1 or another scoring version
Consequently, defenders should use the reported 10.0 score for prioritization but should not infer a specific vector such as unauthenticated network exploitation from the score alone. Verify the authoritative NVD record or a D-Link advisory if a complete vector becomes available.
A maximum score is still operationally significant in this case. The vulnerable function processes attacker-influenced authentication parameters, and the issue is described as remotely executable. Until the authentication and exposure requirements are clarified, organizations should assess the device conservatively and restrict access to the affected service.
Exploitation Status
A public proof-of-concept reference is listed in the NVD material:
https://github.com/Walnut1337/CVE/blob/main/poc/poc_crash.py
The filename indicates a crash-oriented demonstration, but the available material does not reliably establish whether it achieves code execution, bypasses authentication, or only causes a denial-of-service condition. The defensible conclusion is that a public PoC exists, while the PoC’s full capabilities remain unverified.
Active exploitation in the wild is not confirmed by the supplied evidence. CVE-2026-94089 is not listed in the CISA Known Exploited Vulnerabilities catalog, and there is no CISA KEV due date or ransomware-campaign designation for this CVE. KEV absence is not proof that exploitation is impossible or that the device is safe; it only means that CISA’s catalog does not currently provide confirmation.
Treat the public PoC as a meaningful increase in risk. Internet-wide scanning, opportunistic exploitation, or exploitation on exposed consumer routers may occur without being documented in KEV or public incident reporting. Monitor for suspicious requests and prioritize containment even though confirmed in-the-wild exploitation has not been established.
For context on preserving evidence during an investigation, see our guide to what logs should be preserved during a cyber incident.
How to Detect It
Start by inventorying DIR-868L devices and recording their firmware versions. The target firmware identified by the available record is 2.01b05. Review WAN administration settings, firewall rules, port-forwarding policies, and management-interface bindings. A router that is not directly internet-facing can still be exposed to hostile clients on an internal or guest network.
Web-server and firewall logs should be searched for requests to the vulnerable endpoint, especially requests containing unusually long id or password values. A basic web-log search might include:
grep -Ei '(/webfa_authentication\.cgi|[?&](id|password)=)' \
/var/log/*access* /var/log/*http* 2>/dev/null
A generic SIEM query can be adapted to the organization’s field names:
http.uri_path = "/webfa_authentication.cgi"
AND (
url.query CONTAINS "id="
OR url.query CONTAINS "password="
)
Look for repeated requests from one source, requests with unusually large parameter lengths, malformed URL encoding, HTTP 400/500 responses, abrupt management-service restarts, router reboots, or configuration changes immediately after a suspicious request. These indicators are not unique to exploitation, and the DIR-868L may have limited logging. Lack of a matching log entry should not be interpreted as evidence that exploitation did not occur.
Network sensors can alert on HTTP requests targeting /webfa_authentication.cgi, particularly when the request is sent to a router management address from an untrusted segment. Avoid placing actual passwords or exploit payloads in detection examples and do not test production devices unless the assessment is authorized.
Organizations reviewing perimeter controls may also benefit from our comparison of WAF services, including Cloudflare and AWS. A WAF cannot repair the router, but upstream filtering and segmentation can reduce exposure where they are technically applicable.
Mitigation and Patching
No vendor-confirmed fixed firmware version was identified in the available sources. The affected version is 2.01b05, but no specific upgrade target can be stated without inventing a D-Link fix. Check D-Link’s official support resources for the DIR-868L and verify the cryptographic integrity and provenance of any firmware before installation.
If D-Link provides a supported fixed release, upgrade through the documented administrative interface or vendor-supported process, then confirm the installed version. Do not assume that an arbitrary later firmware build fixes this CVE. If no supported firmware is available, replacement with a currently supported router is the most durable remediation, particularly for devices exposed to the internet.
Until patch status is verified, apply the following controls:
- Disable remote administration from the WAN.
- Restrict management access to a dedicated administrator subnet or jump host.
- Block inbound access to the router’s management HTTP and HTTPS services at upstream firewalls.
- Remove unnecessary port forwards and confirm that no NAT rule exposes the management interface.
- Segment guest and untrusted wireless networks from the management plane.
- Export configuration backups, preserve relevant logs, and plan replacement if the device is end-of-life or unsupported.
For a Linux-based upstream firewall using nftables, an example workaround is:
nft add rule inet filter input iifname "wan0" tcp dport { 80, 443 } drop
Replace wan0 and the port set with the actual WAN interface and management services. This command protects the upstream firewall, not the DIR-868L itself, and should be implemented only after validating existing firewall policy. Equivalent controls can be applied through a managed firewall, ACL, or router upstream of the vulnerable device.
After containment, inspect the router for unauthorized configuration changes, unexpected DNS settings, new administrator accounts, altered port forwards, and unexplained reboots. If compromise is suspected, preserve available evidence, reset the device using the vendor’s documented procedure, rotate credentials, and replace the unit where firmware provenance or integrity cannot be trusted.
When rotating router and administrator credentials, a password manager such as Try 1Password → can help generate and store unique credentials securely.
References
The primary technical source is the NVD record for CVE-2026-94089, which identifies D-Link DIR-868L firmware 2.01b05, the /webfa_authentication.cgi endpoint, the strcpy-related stack overflow, a reported CVSS score of 10.0, and public exploit disclosure. The available record did not provide a CVSS vector or a vendor-confirmed fixed firmware version.
Additional references include the following:
| Reference | Purpose |
|---|---|
| NVD-listed GitHub PoC | Public crash-oriented proof-of-concept reference |
| VulDB CVE record | Secondary vulnerability record |
| VulDB vulnerability entry | Additional secondary reference |
| VulDB CTI page | Threat-intelligence reference |
| CISA KEV Catalog | Verification source for known exploitation status |
CISA KEV does not currently list CVE-2026-94089. That status should be rechecked during remediation because catalog membership, vendor guidance, and exploit availability can change after publication.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.