CVE-2026-4529
Published: 21 March 2026
Summary
CVE-2026-4529 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dhp-1320 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4529 is a stack-based buffer overflow vulnerability affecting the redirect_count_down_page function within the SOAP Handler component of the D-Link DHP-1320 router running firmware version 1.00WWB04. Published on 2026-03-21, it is rated high severity with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The flaw arises from improper input handling in the affected function, allowing remote manipulation.
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation triggers a stack-based buffer overflow, potentially enabling arbitrary code execution with high impacts on confidentiality, integrity, and availability. As a network-accessible issue (AV:N), it poses risks to exposed D-Link DHP-1320 devices.
Advisories note that the vulnerability affects only products no longer supported by the maintainer, implying no official patches are available. References include a public exploit on GitHub (xiaobor123/vul-finds/tree/main/vul-find-dhp1320-dlink) and details from VulDB (ctiid.352317, id.352317, submit.773932), with the D-Link website listed but no specific mitigation guidance. Practitioners should isolate or retire affected end-of-life devices.
The exploit is publicly available and might be used in the wild, increasing risks for unpatched, internet-facing D-Link DHP-1320 routers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14260
Vulnerability details
A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.…
more
This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable stack-based buffer overflow in the public-facing SOAP Handler of an internet-exposed router, enabling arbitrary code execution and directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires retirement or restriction of unsupported EOL components like the D-Link DHP-1320, preventing exploitation of unpatchable vulnerabilities such as CVE-2026-4529.
Mandates timely identification, reporting, and remediation or mitigation of flaws like the stack-based buffer overflow in CVE-2026-4529, including isolation or replacement of affected EOL devices.
Implements memory protection mechanisms like stack canaries and non-executable memory to directly mitigate stack-based buffer overflow exploits in CVE-2026-4529.