Skip to content

CVE-2026-3485 — OS Command Injection in SSDP Service of D-Link DIR-868L 110b03

alt text

CVE-2026-3485 OS Command Injection SSDP/UPnP Unauthenticated RCE

Overview

CVE-2026-3485 is an OS command injection vulnerability in the SSDP service of D-Link DIR-868L firmware version 110b03. By manipulating the ST argument processed by function sub_1BF84, an attacker can inject shell commands that execute on the router.

Because SSDP/UPnP services are commonly reachable on local networks (and sometimes exposed more broadly due to misconfiguration), this flaw presents significant risk when vulnerable devices remain deployed.

Technical Specifications

Attribute Details
CVE ID CVE-2026-3485
Vulnerability Type OS command injection
Severity CVSS 9.8 (Critical)
Affected Product D-Link DIR-868L
Affected Firmware 110b03
Affected Component SSDP service (UPnP discovery path)
Vulnerable Function sub_1BF84
Authentication Requirement None
Attack Vector Network-reachable SSDP service

Affected Products

  • D-Link DIR-868L routers running firmware 110b03
  • Deployments with SSDP/UPnP enabled and reachable from attacker-controlled network segments
  • Environments where edge filtering/firewalling allows unintended SSDP exposure
  • Status: Product support lifecycle concerns increase remediation risk

Technical Details

Vulnerability Mechanics

  • The SSDP service processes the ST argument without proper sanitization.
  • Input passed into function sub_1BF84 can include shell metacharacters/command fragments.
  • Unsafe processing results in arbitrary OS command execution on the router.

Exposure Conditions

  • SSDP is typically enabled for UPnP discovery on local networks.
  • If filtering is weak or misconfigured, reachable attack surface may extend beyond intended boundaries.
  • No authentication or user interaction is required once the vulnerable service is reachable.

Security Posture Concern

  • The affected platform is reportedly no longer actively supported.
  • Lack of official patch availability can create persistent long-term exposure.

Attack Scenario

  1. Service Discovery:

    • Attacker identifies a reachable DIR-868L target exposing SSDP service behavior.

  2. Crafted Packet Delivery:

    • Attacker sends specially crafted SSDP traffic with malicious ST parameter content.

  3. Command Injection Trigger:

    • Unsanitized input is processed and passed into command execution context.

  4. Remote Code Execution:

    • Arbitrary commands execute on router OS, potentially with root-level privileges.

  5. Post-Compromise Actions:

    • Attacker installs persistence, manipulates traffic, recruits device into botnet activity, or pivots into internal network assets.

Impact Assessment

  • Full router compromise and unauthorized system command execution
  • Malicious configuration changes to routing/firewall/DNS behavior
  • Persistent backdoor deployment on gateway infrastructure
  • Ability to intercept or redirect network traffic traversing the router
  • Elevated risk of credential/session theft from connected devices
  • Potential reconnaissance and compromise of internal hosts
  • Service disruption or router instability from malicious command execution
  • Use of compromised router in DDoS/botnet campaigns
  • Increased outage risk in environments dependent on aging edge hardware

Mitigation Strategies

Short-Term Actions

  • Disable SSDP/UPnP on affected routers where operationally feasible
  • Remove vulnerable device exposure to untrusted networks, especially direct internet reachability
  • Apply any available firmware updates if vendor releases related remediation

Long-Term Strategy

  • Replace affected hardware with supported models receiving active security updates
  • Segment legacy network devices away from critical assets and management zones
  • Enforce strict ingress/egress filtering around consumer-grade edge equipment

Monitoring and Detection

  • Monitor for suspicious SSDP traffic patterns and anomalous command execution indicators
  • Alert on unexpected DNS/routing changes originating from router administration interfaces
  • Inspect network telemetry for botnet-like beaconing or unusual outbound activity

Resources and References

Open-Source References

Last Updated: March 4, 2026