CVE-2026-0732: D-Link DI-8200G command injection in upgrade_filter.asp
A command injection flaw (CWE-77) has been reported in the upgrade_filter.asp file of the D-Link DI-8200G, firmware 17.12.20A1, where the path argument is handled unsafely. NVD lists a base score of 9.8 (critical), and the record states that a public exploit has been made available. No fixed version appears in the sources consulted.
Overview
A command injection flaw (CWE-77) has been reported in the upgrade_filter.asp file of the D-Link DI-8200G, firmware 17.12.20A1. According to the record, the path argument is processed in a way that allows injected commands, and the attack may be performed remotely. Details are summarized from the NVD entry and the VulDB entry.
Impact
If exploited, an attacker could potentially run operating system commands on the affected device. NVD lists a base score of 9.8 with network attack vector, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability. The SSVC data in the record rates technical impact as partial.
Affected products and versions
- D-Link DI-8200G, version 17.12.20A1
- D-Link DI-8200G firmware, version 17.12.20a1
The record does not list any fixed version. Version strings are shown exactly as they appear in the record.
Exploitation status
The CISA KEV catalog does not list this CVE in the data consulted, so no confirmed active exploitation is recorded. The record does state that the exploit has been made public and could be used, and the SSVC exploitation field is marked as proof of concept. Public availability of exploit material is a reason to prioritize action on affected devices.
Remediation and mitigation
- No fixed version is listed in the sources consulted. Check the D-Link website for firmware updates for the DI-8200G and apply any update that addresses this issue.
- Until a fix is verified, restrict access to the web management interface to trusted internal networks and disable remote administration where it is not required.
- Place the device behind network controls that limit which hosts can reach it.
- If the device is end-of-life or no update is available, plan replacement or isolation.
Detection guidance
- Review web server logs for requests to upgrade-related pages, especially from unexpected sources.
- Monitor the device and surrounding network for unexpected outbound connections or traffic patterns.
- Alert on configuration or firmware changes that were not authorized.
Limitations of the available information
The record does not identify the exact vulnerable code path, the full set of affected firmware builds, or any vendor fix. Scores from VulDB and the CNA range from 2.1 to 6.5, which differs from the NVD base score. One reference carries a Permissions Required tag, which conflicts with the NVD indication that no privileges are required, so this should be verified. The EPSS values are dated 2026-10-23, which should be checked before relying on them.
Frequently asked questions
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE in the data consulted, so no confirmed active exploitation is recorded. The record does state that a public exploit has been made available, which makes prompt review of affected devices advisable.
Is there a fixed version available?
No fixed version is listed in the sources consulted. This means the information is missing, not that no fix exists, so check the vendor for firmware updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.