PT-2026-35274

CVE-2026-7067

Published

2026-04-26

Updated

2026-05-23

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DIR-822 A 101

Description A command injection issue exists in the udhcpd DHCP Service within the system() function of the /udhcpcd/dhcpd.c file. A remote attacker can exploit this by manipulating the Hostname argument to execute arbitrary code. This issue occurs because the software fails to neutralize special elements within the input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Tian

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')