Which versions of D-Link are affected by CVE-2026-4194?

A high-severity vulnerability affecting D-Link NAS devices enables remote attackers to bypass access controls through improper authentication in the system management interface.

How to fix or mitigate CVE-2026-4194?

Within 24 hours: Inventory all D-Link DNS/DNR devices in scope and assess network exposure; isolate affected devices to restricted networks if possible. Within 7 days: Implement network-level controls (WAF rules, IP whitelisting, VPN-only access) to restrict access to /cgi-bin/system_mgr.cgi; disable the affected cgi_set_wto function if feasible through device configuration. Within 30 days: Evaluate replacement of affected devices with patched alternatives or vendors without this vulnerability class; monitor D-Link security advisories for patch release and plan immediate deployment.

D-Link CVE-2026-4194

Q: What is the CVSS score of CVE-2026-4194?

CVE-2026-4194 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12260 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-03-16 cna@vuldb.com

D-Link Information Disclosure

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 14:30 euvd

EUVD-2026-12260

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

Mar 16, 2026 - 14:20 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file /cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

Improper access controls in D-Link NAS devices (DNS-120, DNS-323, DNS-345, DNS-1200-05, and others through firmware version 20260205) allow unauthenticated remote attackers to manipulate the cgi_set_wto function in /cgi-bin/system_mgr.cgi, potentially gaining unauthorized access or modifying system settings. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability resides in the CGI-based web management interface common to D-Link's DNS (Network Storage) and DNR (Network Video Recorder) product lines. The affected cgi_set_wto function in system_mgr.cgi fails to properly validate user permissions before processing requests, resulting in CWE-266 (Incorrect Privilege Assignment). This allows unauthorized users to execute privileged operations that should be restricted to authenticated administrators. The affected devices are consumer and small business NAS solutions that typically store sensitive data and provide network file sharing services.

RemediationAI

No official patches are currently available from D-Link for this vulnerability. Given the apparent end-of-life status of these devices (firmware dated 20260205), users should consider migrating to newer, supported NAS solutions. As immediate mitigation, restrict network access to the affected devices by placing them behind a firewall and limiting access to trusted IP addresses only. Disable remote management features if not required, and ensure the devices are not directly exposed to the internet. Monitor D-Link's security page at https://www.dlink.com/ for any future updates, though support for these older models appears unlikely.