EIP-2026-101614

This advisory describes an unauthenticated OS command injection vulnerability in multiple D-Link devices via the UPnP SOAP interface. The vulnerability allows arbitrary command execution through manipulated XML parameters such as NewInternalClient, NewExternalPort, and NewInternalPort.