CVE-2022-50596 is a critical command injection flaw (CVSS 9.8) in the web management interface of the D-Link DIR-1260 router. Firmware up to and including v1.20B05 lets an unauthenticated attacker run commands as root. D-Link's advisory lists a hotfix firmware; check the advisory and apply it.
What's affected
The CVE record lists D-Link DIR-1260 firmware versions up to and including v1.20B05. D-Link's announcement SAP10298 names all hardware revision A units in the US region and lists the fixed firmware as v1.02B06_Beta Hotfix, with the recommendation to upgrade to the hotfix patch. The same table shows a last update date of 5 May 2022.
The firmware numbers in the vendor table look unusual next to the affected version, so read the announcement itself and follow its download link rather than relying on a number copied from a summary.
How to check if you're exposed
Log in to the router's web interface and read the firmware version from the status page. Compare it with the affected range of v1.20B05 and below.
Then check how the interface is exposed. The record says the management interface is reachable over HTTP and HTTPS on the local and Wi-Fi networks, and optionally from the internet. Confirm that remote administration is turned off, and that the interface is not forwarded through any port mapping.
The vulnerable form is used to show device information before login, which is why no session is needed. That also means anyone who can join your network, including guests, can reach it.
What to do now
- Read the firmware version on every DIR-1260 you manage.
- Open D-Link announcement SAP10298 and download the fixed firmware it lists for your hardware revision.
- Apply the update, then reboot and confirm the new version in the status page.
- Turn off remote administration, and keep the management interface off guest networks.
- If the device is no longer supported or cannot be patched, plan to replace it and keep it off sensitive networks in the meantime.
Why it matters
The class is OS command injection (CWE-78). Input in the SetDest, Dest or Target arguments of the GetDeviceSettings form reaches a system command without being neutralised, so a request can add its own commands. Because the web server on a consumer router runs as root, the result is full control of the device.
Routers sit at the edge of every network behind them. Root on the router gives an attacker a place to watch and change traffic, alter DNS and pivot to other devices. The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list, but unauthenticated root bugs in home and small office gear tend to attract attention. Patch it and shrink the exposure.
Quick check
Do I need to be on the internet side to be attacked?
No. The record says the interface is reachable from local and Wi-Fi networks, and optionally from the internet. Any joined device can reach it.
Where do I find the fixed firmware?
In D-Link announcement SAP10298. Use its download link for your hardware revision.
Sources
Last reviewed: 19 October 2026.
