CVE-2026-94089: Critical Unauthenticated Stack Overflow in D-Link DIR-868L Routers

Overview

A maximum-severity, unauthenticated remote code execution vulnerability has been disclosed in D-Link DIR-868L wireless routers running firmware 2.01b05. Tracked as CVE-2026-94089, the flaw is a classic strcpy stack-based buffer overflow (CWE-121) in the router's webfa_authentication.cgi script — the very endpoint that handles login. A working public proof-of-concept already exists.

Because the bug sits in the authentication handler itself, no valid credentials — or any credentials at all — are needed to trigger it. Anyone who can reach the router's web management interface can attempt exploitation.

Technical Details

How It Works

webfa_authentication.cgi passes the id and password values supplied in a login request directly into a strcpy() call without bounds checking. strcpy copies until it hits a null terminator, not until it hits a buffer limit, so an attacker who submits an oversized id or password string overflows the fixed-size stack buffer the CGI process allocated for it. With careful crafting of the overflow payload, that overwrite can hijack the stack's return address and redirect execution to attacker-supplied shellcode — full compromise of the router's operating environment, achieved with a single crafted HTTP request and zero authentication.

Impact Assessment

Who Is At Risk

• Any DIR-868L deployment still running firmware 2.01b05, particularly units with the web management interface reachable from the WAN side
• Home and small-office networks where this router model handles internet gateway duties — DIR-868L is a long-lived consumer/SOHO product line, so unpatched units are likely still in active service

Potential Impact

• Complete device takeover — arbitrary code execution in the router's authentication process, typically running with elevated privileges on embedded Linux firmware
• Network pivot point — a compromised router sits between every device on the LAN and the internet, making it an ideal platform for traffic interception, DNS hijacking, or lateral movement into the internal network
• Botnet recruitment — unauthenticated, remotely exploitable router RCEs with public PoCs are a standard ingredient for IoT botnet recruitment campaigns

Mitigation

• Disable remote/WAN management on the DIR-868L's admin interface immediately — this closes off the most likely attack path even before a firmware fix ships
• Check for a firmware update from D-Link. DIR-868L is an older product line; if no security patch is issued, treat the device as end-of-life and plan for replacement
• Restrict LAN-side access to the admin interface to trusted management hosts only
• Monitor for anomalous device behavior — unexpected reboots, altered DNS settings, or outbound connections to unfamiliar hosts can indicate compromise
• Given the CVSS 10 rating and public exploit availability, prioritize this over routine patch cycles

References

• NVD — CVE-2026-94089
• VulDB — CVE-2026-94089