Critical severity · published Mar 3, 2026
CVE-2026-3485
D-Link DIR-868L SSDP Service sub_1BF84 os command injection
9.8
CVSS
4.8%
EPSS
No
On KEV
Description
A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
DIR-868L · D-Link
110b03 · source: vendor
DF
Dir-868l Firmware · Dlink
110b03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3485
Exploit
https://kn0sinna.notion.site/dlink-dir-868l-ssdp-command-injection-30eb1876cd6e80caa691de6fe5cab59c
Permissions Required
https://vuldb.com/?ctiid.348560
Third Party Advisory
https://vuldb.com/?id.348560
Third Party Advisory
https://vuldb.com/?submit.764759
Product
https://www.dlink.com/
More from DIR-868L
10.0
CVE-2026-110536
D-Link DIR-868L HNAP CGI cgibin system os command injection
10.0
CVE-2026-94089
D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow