CVE-2026-4499 is an OS command injection flaw in the SSDP component of the D-Link DIR-820LW router, scored CVSS 7.3 (high). It can be reached remotely without credentials, and the record says the exploit is public. I could not confirm a fixed firmware, so check the D-Link advisory.
What's affected
The record names D-Link DIR-820LW firmware 2.03 and the function ssdpcgi_main in the SSDP component. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, no privileges, no user action.
The VulDB page returned an access error when I fetched it, so I have no vendor response or fixed version to report. The record lists the D-Link website as a reference, which is where to look for firmware notes.
How to check if you're exposed
- Open the router admin page and read the firmware version on the status screen. Version 2.03 is the one named in the record.
- Check the D-Link support page for the DIR-820LW for newer firmware or an end of support notice.
- Check whether SSDP is reachable from untrusted networks, in particular the WAN side.
What to do now
- Find every DIR-820LW in your offices, branches and remote worker homes.
- If D-Link publishes fixed firmware, install it and verify the version afterward.
- If no fix exists, plan to replace the device, since a public exploit makes waiting costly.
- Until then, keep remote administration off and block SSDP traffic from the internet.
- Look at router and gateway logs for odd activity around the discovery service.
Why it matters
The weaknesses are CWE-77 and CWE-78: attacker input ends up in a command run by the operating system. On a router that means a foothold at the network edge. The KEV flag is false, but the record states a public exploit exists, which raises the odds of scanning.
Quick check
Is CVE-2026-4499 on the CISA KEV list?
The record's KEV flag is false. The NVD text does say the exploit has been publicly disclosed, so treat it as likely to be tried.
Sources
Last reviewed: 19 October 2026.
