Loading story…
A remote code execution flaw in the Realtek SDK miniigd SOAP service allows attackers to run arbitrary code by sending a crafted NewInternalClient request. The issue, tracked as CVE-2014-8361, was documented by MITRE and linked to an authentication bypass and RCE condition affecting devices built on the vulnerable SDK, including products covered by D-Link advisory SAP10055.
The vulnerability was originally disclosed through multiple security advisories and exploit publications, including references from the Zero Day Initiative, Packet Storm, Exploit-DB, SecurityFocus, and JVN. MITRE’s record notes that the flaw continued to be exploited in the wild through 2023, underscoring the long tail of risk for internet-exposed embedded devices that still rely on the affected Realtek software components.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE-2014-8361 record was updated, and the entry states the vulnerability had been exploited in the wild through 2023.
MITRE published the CVE-2014-8361 record for a remote code execution vulnerability in the Realtek SDK miniigd SOAP service that can be triggered with a crafted NewInternalClient request.
D-Link published security advisory SAP10055 covering an authentication bypass and remote code execution issue in the Realtek SDK miniigd component.
A command injection vulnerability affecting multiple D-Link routers' UPnP SOAP interface was disclosed, allowing shell commands to be injected via the NewInternalClient field of the AddPortMapping action. The issue was reported as affecting tested DIR-300, DIR-600, DIR-645, DIR-845, and DIR-865 devices, with additional models potentially vulnerable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcesecurityadvisories.dlink.com
Open sourceexploit-db.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026
D-Link is investigating two critical flaws reported in `DIR-822A` routers running firmware `A_101`. `CVE-2026-86296` is an unauthenticated, network-reachable stack-based buffer overflow in the `udhcpcd` component, rated CVSS 10.0, that could enable denial of service or remote code execution. A public proof-of-concept exploit has reportedly been released. The second issue, `CVE-2026-86510`, is an out-of-bounds write in the L2TP Control Message Parser, rated 9.9 under CVSS v3.1 and requiring low privileges but no user interaction; public exploit code has also reportedly been released. D-Link has not confirmed the complete affected hardware-revision or regional scope, nor whether remediation is available. Organizations should verify deployed router models and firmware, disable unnecessary remote management, restrict administrative access, and monitor regional D-Link support channels for updates.
Sep 24, 2026
A critical command injection vulnerability, tracked as CVE-2026-0625, has been discovered in multiple legacy D-Link DSL gateway routers. The flaw resides in the `dnscfg.cgi` endpoint, where improper input sanitization allows unauthenticated remote attackers to execute arbitrary shell commands via DNS configuration parameters. Security researchers from VulnCheck and The Shadowserver Foundation have confirmed active exploitation attempts, with evidence captured on honeypots and reports of ongoing campaigns targeting affected devices. The impacted models include DSL-526B (≤ 2.01), DSL-2640B (≤ 1.07), DSL-2740R (< 1.17), and DSL-2780B (≤ 1.01.14), all of which have reached end-of-life and will not receive security updates. D-Link has acknowledged the vulnerability and is working to determine if additional products are affected, citing challenges in identifying all impacted models due to firmware variations. The company strongly advises users to retire and replace vulnerable devices, as no patches will be issued. The vulnerability is rated as critical (CVSS 9.3), and exploitation has been observed in the wild, though the specific threat actors and targets remain unclear. The risk is heightened by the unauthenticated nature of the exploit and the widespread use of these legacy routers in consumer environments.
Jun 29, 2026