Skip to main content

D-Link DNS/DNR NAS CVE-2026-16448

| EUVDEUVD-2026-46265 LOW
Command Injection (CWE-77)
2026-07-21 VulDB GHSA-pcrj-7rmr-mcxc
D-Link Command Injection Dns 120 Dnr 202l Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dnr 322l Dns 323 Dns 325 Dns 326 Dns 327l Dnr 326 Dns 340l Dns 343 Dns 345 Dns 726 4 Dns 1100 4 Dns 1200 05 Dns 1550 04
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-exploitable via web UI with low-privilege auth required; scope unchanged and impact capped at low per CVSS 4.0 VC/VI/VA:L indicating restricted CGI process context.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Jul 21, 2026 - 15:37 NVD
MEDIUM LOW
CVSS changed
Jul 21, 2026 - 15:37 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Jul 21, 2026 - 15:05 vuln.today
CVE Published
Jul 21, 2026 - 14:15 cve.org
MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_check_rsync_rw of the file /cgi-bin/remote_backup.cgi. The manipulation of the argument ip results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege NAS credentials
Delivery
Send crafted HTTP request to /cgi-bin/remote_backup.cgi
Exploit
Inject shell metacharacters in 'ip' argument
Execution
cgi_check_rsync_rw executes unsanitized command
Impact
Arbitrary OS commands run on device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to the device's web management interface and a valid user account with at least low-privilege access (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 with PR:L signals that exploitation requires at least low-privilege authenticated access, which materially limits the attack surface compared to unauthenticated network exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid low-privilege account on the D-Link NAS (or who has obtained such credentials through credential stuffing or default password use) sends a crafted POST request to /cgi-bin/remote_backup.cgi with the 'ip' argument containing shell metacharacters and injected commands. Because the cgi_check_rsync_rw function builds a shell command incorporating the unsanitized input, the injected commands execute in the context of the CGI process on the device. …
Remediation No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dns 120

View all
CVE-2026-4213 HIGH POC
8.8 Mar 16

Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cg
CVE-2026-4214 HIGH POC
8.8 Mar 16

Stack-based buffer overflow in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-326, DNS-1100-4, and
CVE-2026-4212 HIGH POC
8.8 Mar 16

Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to ac
CVE-2026-4211 HIGH POC
8.8 Mar 16

Stack-based buffer overflow in D-Link DNS and DNR network storage devices allows authenticated remote attackers to execu
CVE-2026-5212 HIGH POC
7.4 Mar 31

Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with

CVE-2026-5213 HIGH POC
7.4 Mar 31

Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
CVE-2026-5211 HIGH POC
7.4 Mar 31

Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-16448 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy