EUVD-2026-12287Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.3 (Medium) indicates moderate severity, but multiple signals elevate real-world risk: (1) Attack Vector is Network with Low Complexity and requires only Login privilege (PR:L), meaning any authenticated user—including guest accounts on many D-Link devices—can exploit; (2) Public exploit code is available (E:P) on GitHub, lowering the barrier to weaponization; (3) The CVSS Exploitability rating (E:P, RC:R) suggests proven exploitation is realistic; (4) Command injection on NAS devices typically yields root-level access to sensitive data (user files, backups, credentials), making the actual business impact (C:L/I:L/A:L is understated) more severe than CVSS suggests for confidentiality and integrity; (5) Affected products are legacy/older NAS units many users may not actively patch. However, the PR:L requirement (authenticated attacker) prevents unauthenticated remote exploitation, reducing CVSS from Critical to Medium. Real priority: HIGH for organizations running D-Link NAS devices, particularly if guest/default credentials are enabled or if internal network access is trusted. This is a post-authentication RCE with publicly available exploits—a practical, high-risk vulnerability despite the medium CVSS score. |
| Exploit ScenarioDerived | An attacker with login credentials (e.g., obtained via default credentials, phishing, or lateral movement within a corporate network) navigates to the web interface of a D-Link DNS-320L NAS device. The attacker crafts a request to /cgi-bin/system_mgr.cgi with a malicious cgi_firmware_upload or cgi_ntp_time parameter containing shell metacharacters, e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Command injection in D-Link NAS devices (DNS-320, DNS-325, DNS-343, DNR-322L and others) through the /cgi-bin/system_mgr.cgi interface allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
A command injection vulnerability exists in D-Link NAS devices across multiple models (DNS-120, DNS-320 series, DNS-1100-4, DNS-1200-05, DNS-1550-04, and others) through the /cgi-bin/system_mgr.cgi endpoint affecting functions like cgi_device, cgi_sms_test, cgi_firmware_upload, and cgi_ntp_time. An authenticated attacker can inject arbitrary OS commands by manipulating parameters, leading to unauthorized code execution with full system privileges. Public exploit code is available, and the vulnerability is tracked as actively disclosed with realistic exploitation probability.
RemediationAI
Patch via firmware update: Check D-Link support website for DNS and DNR model-specific firmware versions released after 20260205. Immediate mitigations pending patches: (1) Restrict network access to /cgi-bin/system_mgr.cgi via firewall rules—block untrusted networks from reaching the NAS management interface; (2) Disable unnecessary CGI functions if configuration permits (disable SMS test, firmware upload if not needed); (3) Enforce strong authentication and disable guest/default accounts; (4) Monitor system logs for suspicious cgi_device, cgi_sms_test, cgi_firmware_upload, or cgi_ntp_time requests with special characters or command syntax (backticks, pipes, semicolons); (5) Isolate affected NAS devices to trusted network segments only. No patch versions are explicitly mentioned in references; contact D-Link support directly or monitor their security advisory pages for available firmware releases addressing CVE-2026-4207.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic OS command injection flaw. The affected endpoint is the CGI application /cgi-bin/system_mgr.cgi, which is the system management interface common across D-Link's NAS product line. The vulnerable functions (cgi_device, cgi_sms_test, cgi_firmware_upload, cgi_ntp_time) accept user-supplied input via HTTP parameters that are passed unsanitized to shell commands or system execution routines. Affected products include NAS models from D-Link's consumer and small business lines spanning DNS-1xx, DNS-3xx, DNS-7xx, DNS-1100, DNS-1200, and DNS-1550 series. The CPE data indicates multiple affected products across versions up to firmware date 20260205, suggesting the vulnerability affects all current and recent firmware versions of these models without patching.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_device/cgi_sms_test/cgi_firmware_upload/cgi_ntp_time of the file /cgi-bin/system_mgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4207, a command injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in D-Link DNS NAS Command Injection Flaws
View all 11Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up t
Exploit-DB