Which versions of Dnr 202l are affected by CVE-2026-4207?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4207, a command injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4207?

Yes, a public proof-of-concept exploit is available for CVE-2026-4207. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-4207?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Dnr 202l CVE-2026-4207

Q: What is the CVSS score of CVE-2026-4207?

CVE-2026-4207 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-12287 LOW

Command Injection (CWE-77)

2026-03-16 VulDB

Command Injection D-Link Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 04:00 euvd

EUVD-2026-12287

Analysis Generated

Mar 16, 2026 - 04:00 vuln.today

CVE Published

Mar 16, 2026 - 02:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_device/cgi_sms_test/cgi_firmware_upload/cgi_ntp_time of the file /cgi-bin/system_mgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Command injection in D-Link NAS devices (DNS-320, DNS-325, DNS-343, DNR-322L and others) through the /cgi-bin/system_mgr.cgi interface allows authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic OS command injection flaw. The affected endpoint is the CGI application /cgi-bin/system_mgr.cgi, which is the system management interface common across D-Link's NAS product line. The vulnerable functions (cgi_device, cgi_sms_test, cgi_firmware_upload, cgi_ntp_time) accept user-supplied input via HTTP parameters that are passed unsanitized to shell commands or system execution routines. Affected products include NAS models from D-Link's consumer and small business lines spanning DNS-1xx, DNS-3xx, DNS-7xx, DNS-1100, DNS-1200, and DNS-1550 series. The CPE data indicates multiple affected products across versions up to firmware date 20260205, suggesting the vulnerability affects all current and recent firmware versions of these models without patching.

RemediationAI

Patch via firmware update: Check D-Link support website for DNS and DNR model-specific firmware versions released after 20260205. Immediate mitigations pending patches: (1) Restrict network access to /cgi-bin/system_mgr.cgi via firewall rules—block untrusted networks from reaching the NAS management interface; (2) Disable unnecessary CGI functions if configuration permits (disable SMS test, firmware upload if not needed); (3) Enforce strong authentication and disable guest/default accounts; (4) Monitor system logs for suspicious cgi_device, cgi_sms_test, cgi_firmware_upload, or cgi_ntp_time requests with special characters or command syntax (backticks, pipes, semicolons); (5) Isolate affected NAS devices to trusted network segments only. No patch versions are explicitly mentioned in references; contact D-Link support directly or monitor their security advisory pages for available firmware releases addressing CVE-2026-4207.