# CVE-2026-52356: D-Link DAP1160L OS command injection in diagnostic endpoint

Source: https://junglewise.ai/threats/cve-2026-52356-an-os-command-injection-vulnerability-in-the-htdocs-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-52356 · Severity: info · Published 2026-10-23

A wireless access point used to extend network coverage contains a command injection flaw in its diagnostic tools. An attacker with network access and valid credentials can inject shell commands to execute arbitrary code on the device, potentially gaining full control and using it as a foothold to attack the broader network.

Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-52356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52356 being exploited in the wild.

**How severe is CVE-2026-52356?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** D-Link DAP1160L A1_FW101WWb04.

**Is there a fix for CVE-2026-52356?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52356 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52356?** Check whether you run D-Link DAP1160L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /htdocs/web/diagnostic.php endpoint in D-Link DAP1160L firmware passes unsanitized user input from the dst POST parameter directly to system calls via the xmldbc function. An authenticated attacker can inject shell metacharacters to execute arbitrary OS commands. The vulnerability requires valid authentication credentials to exploit.

## Affected products

- D-Link DAP1160L A1_FW101WWb04

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md](https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md)
- [https://www.dlink.com/en/security-bulletin/](https://www.dlink.com/en/security-bulletin/)