CVE-2026-4499: D-Link Dir-820lw Firmware

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

• D-Link Dir-820lw Firmware: version 2.03 only

Published 2026-03-20. Last modified 2026-06-17.