Is CVE-2026-8345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8345 being exploited in the wild.

How severe is CVE-2026-8345?

Medium severity, with a CVSS score of 6.3, published 11 May 2026.

Which products and versions are affected?

D-Link DIR-816 1.10CNB05_R1B011D88210.

Is there a fix for CVE-2026-8345?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8345 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-8345?

Check whether you run D-Link DIR-816 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8345: D-Link DIR-816 command injection in singlePortForward

CVE-2026-8345 · Severity: medium · CVSS 6.3 · Published 2026-05-11

A security vulnerability exists in the D-Link DIR-816 router, a device used to provide internet connectivity and manage home or small office networks. An attacker can exploit a flaw in the port forwarding settings to inject malicious commands into the device's operating system. If successful, this allows the attacker to gain unauthorized control over the router, potentially leading to intercepted traffic, network disruptions, or further attacks on connected devices.

Technologies: D-Link DIR-816. Vendors: D-Link.

Quick answers

Is CVE-2026-8345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8345 being exploited in the wild.
How severe is CVE-2026-8345?: Medium severity, with a CVSS score of 6.3, published 11 May 2026.
Which products and versions are affected?: D-Link DIR-816 1.10CNB05_R1B011D88210.
Is there a fix for CVE-2026-8345?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8345 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-8345?: Check whether you run D-Link DIR-816 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored command injection vulnerability exists in the D-Link DIR-816 router (firmware version 1.10CNB05_R1B011D88210) within the /goform/singlePortForward endpoint. The vulnerability is rooted in the sub_445E7C function, which performs insufficient validation on the 'ip_address' parameter using only inet_aton(). This allows a malicious string to be saved into the 'SinglePortForwardRules' NVRAM variable. When these rules are subsequently applied, the sub_448A34 function retrieves the stored value and passes it to sub_447560, which constructs an iptables DNAT command. Because the input is not escaped before being passed to doSystem(), an attacker with low privileges can execute arbitrary shell commands with the permissions of the web process.

Affected products

D-Link DIR-816 1.10CNB05_R1B011D88210

Timeline

2026-05-11: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.