CVE-2026-4627
Published: 24 March 2026
Summary
CVE-2026-4627 is a high-severity Command Injection (CWE-77) vulnerability in Dlink (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 21.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4627 is an OS command injection vulnerability (CWE-77, CWE-78) affecting the handler_update_system_time function in the libdeuteron_modules.so file, which is part of the NTP Service component on D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1. Published on 2026-03-24, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). This issue only impacts products that are no longer supported by the maintainer.
The vulnerability enables remote exploitation over the network with low attack complexity, though it requires high privileges (PR:H) and no user interaction. An attacker with sufficient access can manipulate inputs to inject and execute arbitrary operating system commands, achieving high impacts on confidentiality, integrity, and availability.
VulDB advisories (e.g., https://vuldb.com/?ctiid.352495, https://vuldb.com/?id.352495) document the vulnerability details and submission, while the D-Link website (https://www.dlink.com/) is referenced generally. No patches are available, as the affected products are unsupported by the maintainer.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14736
Vulnerability details
A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_time of the file libdeuteron_modules.so of the component NTP Service. The manipulation results in os command injection. The attack may be launched remotely. This vulnerability only…
more
affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in network device NTP/web handler directly enables arbitrary command execution via Network Device CLI (T1059.008) and exploitation of a remotely accessible management interface (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates inputs to the handler_update_system_time function in the NTP service to block OS command injection exploits.
Requires replacement, prohibition, or isolation of unsupported D-Link DIR-825 and DIR-825R routers with this unpatched vulnerability.
Enforces least privilege to limit high-privilege (PR:H) access required for remote exploitation of the NTP service command injection.