CVE-2026-5844: Command Injection in D-Link DIR-882

Successful exploitation of CVE-2026-5844 grants an attacker complete control over the affected D-Link DIR-882 router. This includes the ability to modify system configurations, install malware, and potentially pivot to other devices on the network. Given the router's position as a gateway, a compromised device can serve as a launchpad for broader network attacks, including data exfiltration and denial-of-service. The public availability of the exploit significantly increases the risk of widespread exploitation, particularly targeting vulnerable, unpatched devices.

1. Reserved2026-04-08
2. Published2026-04-09
3. EPSS updated2026-04-16

Due to the product's end-of-life status, a direct patch is unavailable. Mitigation strategies focus on limiting the attack surface and detecting malicious activity. Network segmentation is crucial; isolate the DIR-882 router from critical network resources. Implement a Web Application Firewall (WAF) with rules to filter suspicious requests targeting prog.cgi and specifically block attempts to inject OS commands via the IPAddress parameter. Monitor router logs for unusual activity and command execution attempts. Consider replacing the DIR-882 router with a supported device as the most effective long-term solution.