Which versions of D-Link are affected by CVE-2026-4197?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4197, a injection vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2026-4197?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

D-Link CVE-2026-4197

Q: What is the CVSS score of CVE-2026-4197?

CVE-2026-4197 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-12265 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-16 cna@vuldb.com

D-Link Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 14:30 euvd

EUVD-2026-12265

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

Mar 16, 2026 - 14:20 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function RSS_Get_Update_Status/RSS_Update/RSS_Channel_AutoDownlaod/RSS_Add/RSS_Channel_Item_Downlaod/RSS_History_Item_List/RSS_Item_List of the file /cgi-bin/download_mgr.cgi. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

Command injection in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-325 series, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 up to firmware version 20260205) allows authenticated remote attackers to execute arbitrary commands through the /cgi-bin/download_mgr.cgi file's RSS management functions. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

This vulnerability is a command injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output) in the web administration interface of D-Link network-attached storage devices. The affected CGI script /cgi-bin/download_mgr.cgi fails to properly sanitize user-supplied input parameters used in RSS feed operations before passing them to system commands, allowing shell metacharacter injection. The vulnerability affects D-Link's proprietary firmware implementation across their DNS-series consumer and mid-range NAS products and DNR-series models. The attack requires valid authentication credentials, limiting the attack surface to authenticated users with access to the device's web interface, typically local network administrators or compromised accounts.

RemediationAI

Immediate mitigation requires upgrading affected D-Link NAS devices to firmware versions released after 20260205, with users directed to D-Link's security advisory and download portal at https://www.dlink.com/ for device-specific patches. Until firmware updates are available or deployable, network-level controls should be implemented including: restricting web administration interface access (port 80/443) to trusted management networks via firewall rules, disabling RSS feed functionality if not operationally required, enforcing strong authentication credentials and changing any default or shared passwords, and isolating affected NAS devices to segmented networks. Additionally, monitor device logs for suspicious RSS-related parameter values or unexpected process execution patterns. Organizations should prioritize patching devices handling sensitive data or serving critical infrastructure roles, and implement network-based intrusion detection signatures targeting command injection patterns in RSS feed parameters as interim monitoring.