CVE-2026-4499
Published: 20 March 2026
Summary
CVE-2026-4499 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dir-820Lw Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing inputs to the ssdpcgi_main function, blocking manipulation via the HTTP_ST environment variable.
Remediates the specific command injection flaw in the SSDP component through timely identification, reporting, and patching of the D-Link DIR-820LW firmware.
Boundary protection limits remote network access to the vulnerable SSDP CGI service, reducing opportunities for unauthenticated exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated OS command injection in SSDP CGI enables exploitation of public-facing application (T1190) and command execution on network device (T1059.008).
NVD Description
A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may…
more
be utilized.
Deeper analysisAI
CVE-2026-4499 is an OS command injection vulnerability affecting the ssdpcgi_main function within the SSDP component of D-Link DIR-820LW firmware version 2.03. Published on 2026-03-20, it stems from CWE-77 and CWE-78 weaknesses, where manipulation of inputs leads to arbitrary command execution.
The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and maintaining unchanged scope (S:U). Attackers can achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as reflected in its CVSS v3.1 base score of 7.3. The exploit has been publicly disclosed and is available for use.
Advisories and details are documented across multiple sources, including GitHub repositories hosting the exploit ZIP file and issue trackers, as well as VulDB entries (ctiid.352055, id.352055, submit.773883), which confirm the remote OS command injection via the HTTP_ST environment variable in the ssdpcgi_main function. No specific patch details are outlined in the provided information.
Details
- CWE(s)