CVE-2026-94089Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-121

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 4 mentions (2026-09-21); latest day: 1
7 total mentions across 4 days

Deep dive

Activity timeline7 mentions / 4d

Signal classification4 categories

Disclosure

457.1%

General

114.3%

PoC

114.3%

Exploit

114.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	1	Disclosure1
2026-09-21	4	Disclosure2General1PoC1
2026-09-22	1	Disclosure1
2026-10-20	1	Exploit1

Full discourse7 posts

Ryx@PadhiyarRushi44d
PoC
D-Link DIR-868L unauth stack overflow PoC is PUBLIC!! CVE-2026-94089 (CVSS 10.0): strcpy overflow in /webfa_authentication.cgi Authentication Handler. Remote, no auth. Affects firmware 2.01b05. Exploit disclosed. https://www.thehackerwire.com/vulnerability/CVE-2026-94089/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #RCE #IoT
Post summary
The tweet announces a public PoC for CVE‑2026‑94089, a critical stack‑overflow flaw in D‑Link DIR‑868L firmware, and provides technical details but no exploit code or patch information.
0201851.6K
954 followersView on X
ExploitGrid@exploitgrid44d
General
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-88854 - EXPLOIT CVE-2026-94036 - EXPLOIT CVE-2026-94003 CVE-2026-94089 CVE-2026-94097 ..🧵👇
Post summary
The tweet lists several CVEs, marking two as 'EXPLOIT' but offers no further details on PoC, exploit code, patches, or active exploitation, making it a general vulnerability notice.
1102097
403 followersView on X
ExploitGrid@exploitgrid43d
Disclosure
🟠 HIGH PRIORITY ├ CVE-2026-94003 — Comfast CF-N1-S · Stack overflow ├ CVE-2026-94089 — D-Link DIR-868L · strcpy stack smash └ CVE-2026-94097 — Netcore NBR200V2 · Command injection
Post summary
The text announces three CVEs (CVE-2026-94003, CVE-2026-94089, CVE-2026-94097) with their vulnerability types (stack overflow, strcpy stack smash, command injection) but provides no PoC, exploit code, active exploitation claims, patches, or mitigation details.
1000026
202 followersView on X
ExploitGrid@exploitgrid44d
Disclosure
🟠 HIGH PRIORITY CVE-2026-94003: Comfast CF-N1-S · Stack overflow CVE-2026-94089: D-Link DIR-868L · strcpy stack smash CVE-2026-94097: Netcore NBR200V2 · Command injection
Post summary
The tweet announces three CVEs with brief descriptions of their vulnerability types but provides no PoC, exploit tools, active exploitation claims, patches, or false‑positive statements.
1000050
155 followersView on X
ExploitGrid@exploitgrid44d
Disclosure
[CVE] CVE-2026-94089 [HIGH PRIORITY] #D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based ov... 🔗 https://exploitgrid.net/cve/CVE-2026-94089
Post summary
The tweet discloses CVE‑2026‑94089, a high‑priority stack‑based overflow in D‑Link DIR‑6868L's webfa_authentication.cgi, linking to exploitgrid.net for more details.
1000036
155 followersView on X
Hugo | DevOps | Cybersecurity@HugoValters16d
Exploit
CVE-2026-94089: critical stack buffer overflow in D-Link DIR-868L auth handler, remote, public exploit, CVSS 10, no patch yet. Stop exposing the web UI and update now: #CVE #infosec #DLink https://www.valtersit.com/cve/CVE-2026-94089 #DLink #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text reports CVE-2026-94089 as a critical stack buffer overflow in D-Link DIR-868L with a public exploit available, CVSS 10, no patch yet, and recommends stopping web UI exposure and updating as a workaround.
0000051
1.1K followersView on X
VulDB 🛡@vuldb45d
Disclosure
A new vulnerability with increased severity was disclosed for D-Link DIR-868L (CVE-2026-94089) https://vuldb.com/vuln/408017
Post summary
The post is a straightforward disclosure announcement for CVE-2026-94089 affecting D-Link DIR-868L, noting increased severity and linking to a VulDB entry, with no additional technical details, PoCs, exploits, or remediation guidance provided.
00000170
2.3K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-94089

Ryx[verified]@PadhiyarRushiPoC

The tweet announces a public PoC for CVE‑2026‑94089, a critical stack‑overflow flaw in D‑Link DIR‑868L firmware, and provides technical details but no exploit code or patch information.

Hugo | DevOps | Cybersecurity[verified]@HugoValtersExploit

The text reports CVE-2026-94089 as a critical stack buffer overflow in D-Link DIR-868L with a public exploit available, CVSS 10, no patch yet, and recommends stopping web UI exposure and updating as a workaround.

ExploitGrid@exploitgridGeneral

The tweet lists several CVEs, marking two as 'EXPLOIT' but offers no further details on PoC, exploit code, patches, or active exploitation, making it a general vulnerability notice.

ExploitGrid@exploitgridDisclosure

The text announces three CVEs (CVE-2026-94003, CVE-2026-94089, CVE-2026-94097) with their vulnerability types (stack overflow, strcpy stack smash, command injection) but provides no PoC, exploit code, active exploitation claims, patches, or mitigation details.

ExploitGrid@exploitgridDisclosure

The tweet announces three CVEs with brief descriptions of their vulnerability types but provides no PoC, exploit tools, active exploitation claims, patches, or false‑positive statements.

ExploitGrid@exploitgridDisclosure

The tweet discloses CVE‑2026‑94089, a high‑priority stack‑based overflow in D‑Link DIR‑6868L's webfa_authentication.cgi, linking to exploitgrid.net for more details.

VulDB 🛡@vuldbDisclosure

The post is a straightforward disclosure announcement for CVE-2026-94089 affecting D-Link DIR-868L, noting increased severity and linking to a VulDB entry, with no additional technical details, PoCs, exploits, or remediation guidance provided.