D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the shell command.
CVE-2025-63932
CVSS base score
7.3 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-78
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
dlink dir-868l firmware
References
- github.com Exploit, Third Party Advisory
- github.com Exploit, Third Party Advisory
- www.dlink.com Product