{"id":"CVE-2026-52356","kind":"vulnerability","aliases":["CVE-2026-52356"],"related":[],"title":"D-Link DAP1160L: diagnostic page lets attackers run arbitrary OS commands","description":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","summary":"The /htdocs/web/diagnostic.php endpoint on D-Link DAP1160L access points (firmware A1_FW101WWb04) passes input to a shell without sanitizing shell metacharacters. An attacker who can reach the page can run arbitrary operating system commands on the device.","severity":"unknown","cvss":null,"epss":0.00842,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["d-link","dap1160l","embedded","infrastructure","router","wifi"],"not_affected_if":["no-dap1160l-devices"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T16:16:51+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:52:06+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:52:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"D-Link DAP1160L: diagnostic page lets attackers run arbitrary OS commands","impact":"high","summary":"The /htdocs/web/diagnostic.php endpoint on D-Link DAP1160L access points (firmware A1_FW101WWb04) passes input to a shell without sanitizing shell metacharacters. An attacker who can reach the page can run arbitrary operating system commands on the device.","category":"infrastructure","nicknames":[],"who_cares":["d-link","dap1160l","router","wifi","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the access point","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-52356 for CVSS, authentication requirement and whether D-Link has published a fixed firmware version.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-dap1160l-devices"],"who_is_affected":"Owners of D-Link DAP1160L access points running firmware A1_FW101WWb04 whose web interface is reachable by an attacker. The sources do not say whether authentication is required or whether the flaw is reachable from the internet. Teams with no DAP1160L devices can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3312,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-52356':15A,18A '/htdocs/web/diagnostic.php':28B,72C 'a1':38B,79C 'access':35B 'allow':81C 'arbitrari':10A,58B,85C,89C 'attack':8A,50B,82C 'command':12A,61B,67C,86C 'cve':13A,16A 'd':2A,20B,32B,76C 'd-link':1A,19B,31B,75C 'dap1160l':4A,22B,34B,78C 'devic':64B 'diagnost':5A 'embed':23B 'endpoint':29B,73C 'execut':84C 'firmwar':37B 'fw101wwb04':39B,80C 'infrastructur':24B 'inject':68C,88C 'input':41B 'let':7A 'link':3A,21B,33B,77C 'metacharact':48B,91C 'oper':59B 'os':11A,66C 'page':6A,55B 'pass':40B 'point':36B 'reach':53B 'router':25B 'run':9A,57B 'sanit':46B 'shell':44B,47B,90C 'system':60B 'via':87C 'vulner':69C 'wifi':26B 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Owners of D-Link DAP1160L access points running firmware A1_FW101WWb04 whose web interface is reachable by an attacker. The sources do not say whether authentication is required or whether the flaw is reachable from the internet. Teams with no DAP1160L devices can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T16:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52356","severity":null,"published_at":"2026-10-23T16:16:51+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-52356","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52356","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}