CVE-2026-4180 is an improper access control flaw (CVSS 7.3) in the D-Link DIR-816 router, firmware 1.10CNB05. The record says an exploit is public and the product is no longer supported, so no fix is expected. Replace the router.
What's affected
Per the NVD record, D-Link DIR-816 firmware 1.10CNB05 is affected, in the redirect.asp file of the goahead component, through the token_id argument. The record says the attack may be started remotely, that the exploit is publicly available, and that the vulnerability only affects products that are no longer supported by the maintainer.
I could not load the VulDB or D-Link pages listed in the record, so treat the record text as the source and check D-Link's site for any notice.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the status page. If you run a DIR-816, assume it is affected. Also check whether the router's web interface is reachable from the internet, through remote management settings or port forwarding.
For a business, search your asset inventory or network scan for D-Link devices and note model names.
What to do now
- Plan to replace the DIR-816 with a supported router that still receives security updates.
- Turn off remote administration, so the admin interface is reachable from the local network only.
- Change the admin password to a long unique one, and keep the device behind a firewall until replaced.
- Do not expose the admin interface through port forwarding.
- Record the replacement date and retire the device from your inventory.
Why it matters
The record lists CWE-266, incorrect privilege assignment, and CWE-284, improper access control. The moderate CVSS vector reflects limited impact on confidentiality, integrity and availability.
The real issue is the lifecycle: a published exploit and no vendor patch. With end of life hardware, the only complete fix is replacement. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, though it says an exploit is public.
Quick check
Can a firmware update fix this?
The record says the product is no longer supported, so no fix is expected. Replace the device.
Sources
Last reviewed: 19 October 2026.
