View Ridge Security
Back to Cyber Hose

CVE-2026-94089: D-Link DIR-868L pre-auth stack buffer overflow

Critical unauthenticated RCE in D-Link DIR-868L firmware 2.01b05 allows root code execution via crafted HTTP requests.

🕵️ RESEARCH & DEEP DIVES

  • CVE-2026-94089: D-Link DIR-868L pre-auth stack buffer overflow enables unauthenticated RCE CVE-2026-94089 A critical unauthenticated remote code execution vulnerability (CVE-2026-94089) exists in D-Link DIR-868L firmware 2.01b05.
    • Affects D-Link DIR-868L routers running firmware version 2.01b05; rated CVSS 10.0 Critical.
    • Stack-based buffer overflow (CWE-119) in the strcpy call within /webfa_authentication.cgi when processing id and password arguments.
    • Exploitation requires no authentication — a crafted HTTP request with oversized id or password parameters overwrites the stack and yields arbitrary code execution, typically with root privileges.
    • A verified public proof-of-concept exploit is available on GitHub (Walnut1337's poc_crash.py); not listed in CISA KEV.
    • Detection indicators: HTTP requests to /webfa_authentication.cgi with abnormally long id/password values, 500-series errors, web daemon crashes, or unexpected outbound connections from the router. 📄 Source: github.com · 📎 Coverage: thehackerwire.com · 👁 via thehackerwire.com (discovered)

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check