CVE-2026-2193
Published: 08 February 2026
Summary
CVE-2026-2193 is a medium-severity Injection (CWE-74) vulnerability in Dlink Di-7100G C1 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of untrusted inputs like the usb_username argument in the set_jhttpd_info function.
Mandates timely flaw remediation to patch the specific command injection vulnerability in the D-Link router firmware.
Enforces input restrictions at system boundaries to block malformed or malicious usb_username values that enable command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in router web interface enables remote exploitation of services (T1210) and arbitrary command execution akin to network device CLI abuse (T1059.008).
NVD Description
A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argument usb_username results in command injection. Remote exploitation of the attack is possible.
Deeper analysisAI
CVE-2026-2193 is a command injection vulnerability affecting the D-Link DI-7100G C1 router running firmware version 24.04.18D1. The issue resides in the set_jhttpd_info function, where manipulation of the usb_username argument enables attackers to inject arbitrary commands. This flaw, associated with CWE-74 and CWE-77, carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility and low complexity.
An attacker with low privileges, such as an authenticated user, can exploit this vulnerability remotely without user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through command injection, potentially enabling unauthorized command execution on the device.
Advisories detailing the vulnerability are available from sources including VulDB (ctiid.344896, id.344896, submit.749803) and a GitHub repository on IoT vulnerabilities. Vendor guidance can be found at dlink.com, where security practitioners should consult for any recommended patches or mitigation steps.
Details
- CWE(s)