CVE-2026-11555: D-Link DGS-1100-08PD Web boa.conf least privilege violation
A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Interface. Such manipulation leads to least privilege violation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the web management interface if it is not required. If web management is required, restrict access so the web interface is only reachable from a dedicated management VLAN or a small set of trusted administrative IP addresses.
D-Link DGS-1100-08PD Web Interface web_interface = disabled or restricted to management VLAN/trusted IPs - Compensating control
Block or restrict network access to the device's web management ports at the perimeter firewall/ACLs — do not allow Internet access to the management interface; only permit trusted IPs or networks to reach the device.
- Operational
Monitor and audit /etc/boa.conf and web interface-related files for unauthorized modifications (file integrity monitoring); review logs for attempts to exploit the web interface and restore configuration from a known-good backup if unauthorized changes are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11555?
The severity of CVE-2026-11555 is classified as low with a score of 3.7.
What is CVE-2026-11555?
CVE-2026-11555 is a vulnerability identified in D-Link DGS-1100-08PD affecting the Web Interface's handling of the boa.conf file, leading to a least privilege violation.
How do I fix CVE-2026-11555?
To fix CVE-2026-11555, ensure that your D-Link DGS-1100-08PD is updated to the latest firmware version that addresses this vulnerability.
What components are affected by CVE-2026-11555?
CVE-2026-11555 specifically affects the Web Interface component of the D-Link DGS-1100-08PD device.
Can CVE-2026-11555 be exploited remotely?
Yes, CVE-2026-11555 can be exploited remotely, requiring a high level of complexity for the attack.