# CVE-2026-8344: D-Link DIR-816 command injection in formDMZ.cgi

Source: https://junglewise.ai/threats/cve-2026-8344-d-link-dir-816-command-injection-in-formdmz-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-8344 · Severity: medium · CVSS 6.3 · Published 2026-05-11

A security vulnerability exists in the D-Link DIR-816 router, a device used to provide internet connectivity and networking for homes and small offices. An attacker with access to the router's management interface can inject malicious commands into the device's configuration. If exploited, this could allow the attacker to take control of the router, potentially leading to intercepted internet traffic or a complete loss of network service.

Technologies: [D-Link DIR-816](https://junglewise.ai/threats/technologies/dir-816). Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-8344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8344 being exploited in the wild.

**How severe is CVE-2026-8344?** Medium severity, with a CVSS score of 6.3, published 11 May 2026.

**Which products and versions are affected?** D-Link DIR-816 1.10CNB05_R1B011D88210.

**Is there a fix for CVE-2026-8344?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8344 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8344?** Check whether you run D-Link DIR-816 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the D-Link DIR-816 router (firmware version 1.10CNB05_R1B011D88210) within the /goform/formDMZ.cgi component. The function sub_445E7C fails to properly sanitize the 'DMZIPAddress' parameter, relying on inet_aton() which does not filter shell metacharacters. The unsanitized input is stored in NVRAM and subsequently retrieved by sub_447C28, where it is formatted into an iptables command via snprintf() and executed using doSystem(). An authenticated attacker can exploit this by submitting a crafted DMZ configuration and triggering a firewall refresh, resulting in arbitrary command execution with system privileges.

## Affected products

- D-Link DIR-816 1.10CNB05_R1B011D88210

## Timeline

- 2026-05-11: advisory: Initial disclosure by VulDB and NVD

## References

- [https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/1.md](https://github.com/lipenghai/iot_bug/blob/main/D-Link/DIR816/1.md)
- [https://vuldb.com/submit/811378](https://vuldb.com/submit/811378)
- [https://vuldb.com/vuln/362660](https://vuldb.com/vuln/362660)
- [https://vuldb.com/vuln/362660/cti](https://vuldb.com/vuln/362660/cti)
- [https://www.dlink.com/](https://www.dlink.com/)

## Related threats

- [D-Link DIR-816 command injection in portForward](https://junglewise.ai/threats/cve-2026-8346-d-link-dir-816-command-injection-in-portforward)
- [D-Link DIR-816 command injection in singlePortForward](https://junglewise.ai/threats/cve-2026-8345-d-link-dir-816-command-injection-in-singleportforward)