What is CVE-2026-3485?

CVE-2026-3485 is a critical-severity vulnerability in D-link Dir-868l, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-03-03.

How severe is CVE-2026-3485?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in D-link Dir-868l

CVE-2026-3485

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The explo…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (65.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R.

Affected products

D-link Dir-868l — versions 110b03

Weakness classification (CWE)

References

VDB-348560 | D-Link DIR-868L SSDP Service sub_1BF84 os command injection (vdb-entry, technical-description)
VDB-348560 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
Submit #764759 | D-Link dir-868I REVA1_FW110b03 OS Command Injection (third-party-advisory)
kn0sinna.notion.site/dlink-dir-868l-ssdp-command-injection-30eb1876cd6e80caa691… (exploit)
www.dlink.com/ (product)

Frequently asked questions

What is CVE-2026-3485?: CVE-2026-3485 is a critical-severity vulnerability in D-link Dir-868l, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-03-03.
How severe is CVE-2026-3485?: Critical severity. CVSS v3 base score is 9.8 out of 10.