CVE-2026-0732CWE-74CWE-77

D-Link DI-8200G upgrade_filter.asp command injection

Medium · published January 8, 2026

CVSS v4.0

5.3

EPSS

12%

Percentile

96.0

In the wild

Unconfirmed

What it is

A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.11651 · 96.0th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-01-08T23:32Z

EPSS history

Timeline

08 JAN 23:32Z
D-Link DI-8200G upgrade_filter.asp command injection
cvelistv5