cbcvebase.
CVE-2026-0732
published 2026-01-09

CVE-2026-0732: A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument…

PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
9.95%
95.0th percentile
A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdi-8200g——
dlinkdi-8200g_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/upgrade_filter.asp↗
  • →Exploit targets HTTP POST requests to /upgrade_filter.asp; inspect POST body for the 'path' parameter containing shell metacharacters (;, newline, backtick, pipe, $) to detect command injection attempts.
  • →The attack is remote and unauthenticated (no session requirement noted); perimeter and internal network sensors should both be deployed to catch lateral exploitation as well as inbound attacks.
  • →Traffic is expected in plaintext (HTTP, not HTTPS); TLS inspection is not required for detection.
  • →Map detections to MITRE ATT&CK T1190 (Exploit Public-Facing Application) under tactic TA0001 (Initial Access).
  • →Public exploit PoC is available; treat any matching traffic as high-confidence and high-severity.
  • ·The Snort/Suricata rule uses a fixed URI bsize of 19 bytes for /upgrade_filter.asp; ensure your IDS/IPS is running in a mode that supports the 'bsize' keyword (Suricata 4.1+ or equivalent).
  • ·The PCRE in the rule matches shell metacharacters both raw and URL-encoded (e.g., %3B for ';', %0A for newline); ensure your sensor does NOT perform URL-decoding before matching, or the encoded variants may be missed.
  • ·The affected product is specifically D-Link DI-8200G firmware version 17.12.20A1; scope detection rules to networking equipment segments hosting this device model to reduce false positives. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.