Is CVE-2026-8344 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8344 being exploited in the wild.

How severe is CVE-2026-8344?

Medium severity, with a CVSS score of 6.3, published 11 May 2026.

Which products and versions are affected?

D-Link DIR-816 1.10CNB05_R1B011D88210.

Is there a fix for CVE-2026-8344?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8344 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8344?

Check whether you run D-Link DIR-816 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8344: D-Link DIR-816 command injection in formDMZ.cgi

CVE-2026-8344 · Severity: medium · CVSS 6.3 · Published 2026-05-11

A security vulnerability exists in the D-Link DIR-816 router, a device used to provide internet connectivity and networking for homes and small offices. An attacker with access to the router's management interface can inject malicious commands into the device's configuration. If exploited, this could allow the attacker to take control of the router, potentially leading to intercepted internet traffic or a complete loss of network service.

Technologies: D-Link DIR-816. Vendors: D-Link.

Quick answers

Is CVE-2026-8344 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8344 being exploited in the wild.
How severe is CVE-2026-8344?: Medium severity, with a CVSS score of 6.3, published 11 May 2026.
Which products and versions are affected?: D-Link DIR-816 1.10CNB05_R1B011D88210.
Is there a fix for CVE-2026-8344?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8344 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8344?: Check whether you run D-Link DIR-816 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the D-Link DIR-816 router (firmware version 1.10CNB05_R1B011D88210) within the /goform/formDMZ.cgi component. The function sub_445E7C fails to properly sanitize the 'DMZIPAddress' parameter, relying on inet_aton() which does not filter shell metacharacters. The unsanitized input is stored in NVRAM and subsequently retrieved by sub_447C28, where it is formatted into an iptables command via snprintf() and executed using doSystem(). An authenticated attacker can exploit this by submitting a crafted DMZ configuration and triggering a firewall refresh, resulting in arbitrary command execution with system privileges.

Affected products

D-Link DIR-816 1.10CNB05_R1B011D88210

Timeline

2026-05-11: advisory: Initial disclosure by VulDB and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.