Which versions of D-Link are affected by CVE-2026-4195?

Organizations using A flaw should be aware of moderate risk from CVE-2026-4195, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input.

How to fix or mitigate CVE-2026-4195?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

D-Link CVE-2026-4195

Q: What is the CVSS score of CVE-2026-4195?

CVE-2026-4195 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-12262 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-16 cna@vuldb.com

D-Link Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 14:30 euvd

EUVD-2026-12262

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

Mar 16, 2026 - 14:20 nvd

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown function of the file /cgi-bin/wizard_mgr.cgi. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

Command injection in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-323 through DNS-1550-04 with firmware prior to 20260205) allows authenticated remote attackers to execute arbitrary commands via the /cgi-bin/wizard_mgr.cgi endpoint. Public exploit code is available and no patch is currently available for affected users.

Technical ContextAI

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as Injection) and manifests as command injection in the CGI script wizard_mgr.cgi, a web-based management interface common to D-Link network storage appliances. The affected products are network-attached storage (NAS) devices and DNS/DNR series storage servers that rely on web-based administration through CGI scripts. The root cause stems from insufficient input validation and sanitization of parameters passed to the wizard_mgr.cgi function, allowing attackers to inject shell metacharacters or command sequences. D-Link's legacy web administration interfaces frequently exhibited such vulnerabilities due to minimal input filtering in early-generation CGI implementations.

RemediationAI

Firmware updates addressing this vulnerability should be obtained from D-Link's official website (https://www.dlink.com/), where vendors typically publish security advisories and patched firmware builds for each affected model. Users must immediately update all affected D-Link NAS devices to firmware versions released after 20260205. Until patches are applied, implement network-level controls by restricting access to the device's web administration interface (TCP 80/443) to trusted administrative IP addresses only, using firewall rules or access control lists. Disable remote management if not actively required, enforce strong passwords or multi-factor authentication if supported by the device firmware, and monitor for suspicious CGI requests to /cgi-bin/wizard_mgr.cgi in device logs. For critical deployments, consider placing the NAS behind a reverse proxy with request validation and input filtering rules to prevent command injection payloads from reaching the vulnerable endpoint. Check the advisory references at https://nvd.nist.gov/vuln/detail/CVE-2026-4195 and contact D-Link support for device-specific patching timelines.