Which versions of D-Link are affected by CVE-2026-4203?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4203, a command injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4203?

Yes, a public proof-of-concept exploit is available for CVE-2026-4203. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-4203?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

D-Link CVE-2026-4203

Q: What is the CVSS score of CVE-2026-4203?

CVE-2026-4203 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-12275 LOW

Command Injection (CWE-77)

2026-03-16 VulDB

Command Injection D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 02:00 euvd

EUVD-2026-12275

Analysis Generated

Mar 16, 2026 - 02:00 vuln.today

CVE Published

Mar 16, 2026 - 01:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in D-Link DNS and DNR network attached storage devices allows authenticated remote attackers to execute arbitrary commands through multiple CGI functions in the network management interface. The vulnerability affects numerous models up to firmware version 20260205, and public exploit code is available. An attacker with valid credentials can leverage this to compromise device integrity and potentially access the network.

Technical ContextAI

The vulnerability is a classic command injection flaw (CWE-77: Improper Neutralization of Special Elements used in a Command) in CGI scripts handling network configuration on D-Link DNS/DNR series NAS devices. The affected functions—cgi_portforwarding_add, cgi_portforwarding_del, cgi_portforwarding_modify, cgi_portforwarding_add_scan, cgi_dhcpd_lease, cgi_ddns, cgi_ip, and cgi_dhcpd—accept user input (IP addresses, port numbers, hostnames, DHCP parameters) that is passed unsanitized to system shell commands, likely via shell metacharacters or command substitution operators. The underlying technology involves embedded Linux web servers in NAS appliances using CGI for dynamic configuration. Affected CPE entries span both entry-level (DNS-120, DNS-320 series) and enterprise-grade (DNS-1550-04, DNS-1100-4) models from D-Link's DNS/DNR product families, all running vulnerable firmware versions up to and including 20260205.

RemediationAI

Immediate actions: (1) Identify and inventory all D-Link DNS/DNR devices in your environment using the CPE list above, (2) Check for available firmware updates beyond 20260205 on D-Link support portal (https://www.dlink.com/); if no patches exist, contact D-Link support for security advisory updates, (3) Restrict network access to the web management interface (:80, :443) using firewall rules, allowing only trusted internal subnets, (4) Disable remote management features if not required (disable WAN-side access to /cgi-bin/), (5) Enforce strong authentication: change default credentials immediately and implement account lockout policies, (6) Monitor logs for CGI parameter injection patterns (shell metacharacters in network config requests). Temporary mitigations pending patching: Disable the affected CGI functions if not in use via web interface restrictions, or place devices behind a WAF with command injection detection rules targeting shell operators (;, |, &, `, $(), etc.) in network configuration parameters.