{"id":"CVE-2026-52356","title":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","summary":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-26T15:54:57.787857Z"},"exploitAvailable":true,"published":"2026-10-23","updated":"2026-10-29","sourceUpdated":"2026-10-29T12:11:29.441Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52356","references":[{"url":"https://www.dlink.com/en/security-bulletin/"},{"url":"https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md"}],"tags":["cve.org","exploit-available"],"epss":0.021,"epssPercentile":0.81759,"ingestedAt":"2026-10-23T16:31:11.326Z","slug":"CVE-2026-52356","body":"## Overview\n\nAn OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":229638,"id":"CVE-2026-52356","ts":1793032365498,"field":"exploit_available","old":"false","new":"true"},{"seq":229637,"id":"CVE-2026-52356","ts":1793032365498,"field":"cvss","old":null,"new":"8.8"},{"seq":229636,"id":"CVE-2026-52356","ts":1793032365498,"field":"severity","old":"none","new":"high"}]}