cbcvebase.
CVE-2026-3485
published 2026-03-03

CVE-2026-3485: A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes…

PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.66%
90.7th percentile
A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdir-868l——
dlinkdir-868l_firmware——

Detection & IOCsextracted from sources · hover to see the quote

port1900/udp↗
commandM-SEARCH↗
snort↗
alert udp any any -> $HOME_NET 1900 (msg:"ET WEB_SPECIFIC_APPS D-Link SSDP ST Header Command Injection Attempt (CVE-2025-10629, CVE-2026-3485)"; flow:established,to_server; content:"M-SEARCH "; depth:9; fast_pattern; content:"ST|3a|"; distance:0; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/i-Corner/cve/issues/30; reference:cve,2025-10629; reference:cve,2026-3485; classtype:attempted-admin; sid:2064797; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_09_18, cve CVE_2025_10629, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Detect SSDP M-SEARCH requests on UDP/1900 where the ST header contains OS command injection metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24). ↗
  • →The injection point is the ST (Search Target) header of SSDP M-SEARCH packets, processed by function sub_1BF84 in the SSDP service of D-Link DIR-868L firmware 110b03. ↗
  • →Attack is remotely initiatable and exploits a publicly disclosed PoC; monitor perimeter and internal network segments for inbound SSDP traffic to networking equipment. ↗
  • →Snort/Suricata SID 2064797 (ET rule) covers this CVE alongside CVE-2025-10629; deploy on both perimeter and internal sensors in plaintext TLS state. ↗
  • ·This vulnerability only affects D-Link DIR-868L firmware version 110b03, which is end-of-life and no longer supported by the vendor; no patch will be issued. ↗
  • ·The Snort rule uses flow:established,to_server on UDP, which may require sensor/IDS configuration to handle stateful UDP tracking correctly. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.