CVE-2026-0732 is a command injection flaw in the D-Link DI-8200G, firmware 17.12.20A1, in the /upgrade_filter.asp page. NVD scores it 6.3, medium severity, and says an exploit is public. No fixed firmware is named, so limit admin access and ask D-Link about an update.
What's affected
- Product: D-Link DI-8200G and its firmware, version 17.12.20A1.
- Component: /upgrade_filter.asp, argument path.
- Fixed version: none listed. Check D-Link support for your model.
- Severity: CVSS 6.3, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Low privileges are required, so an admin login is assumed. - Exploitation: the record says an exploit is public. It is not on the CISA KEV list.
How to check if you're exposed
Router and firewall firmware is not scanned by a package manager, so the check is manual.
- Log in to the device admin page and read the firmware version on the status or system page.
- Compare it with the version named in this post.
- Test from outside your network that the management interface does not answer. From a host you own on another network:
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
The report was written against 17.12.20A1. Other builds are not described, so confirm with D-Link.
What to do now
- Open the D-Link support site (https://www.dlink.com/) and look for a newer firmware for your exact model. The CVE record does not name a fixed version.
- If a newer firmware exists, read its release notes, back up the device configuration, and install it during a quiet window.
- Turn off remote administration from the internet. Management should be reachable only from a trusted LAN or VPN.
- Change the admin password if it is shared or old, and remove any accounts you do not use.
- If no update exists and the device sits at the edge of a network that matters, plan its replacement. Record the CVE in your asset register until then.
Why it matters
The weakness is CWE-77 (improper neutralization of special elements in a command), a child of CWE-74 (injection). The public report, filed by an independent researcher, says a crafted HTTP POST request to the page can lead to arbitrary command execution on the device.
The DI-8200G is a business gateway, so the device may hold VPN and routing settings that you would not want exposed. Keep its management plane off the internet even after a patch arrives, because patches for this class of bug tend to come in series.
Quick check
Does the record say which firmware fixes this?
No. It names 17.12.20A1 as affected and lists no fixed version. Ask D-Link support for the current firmware for your model.
Should the management page ever face the internet?
No. Limit it to a trusted LAN or a VPN. That removes a whole class of remote attacks, not just this one.
Sources
Last reviewed: 19 October 2026.
