EUVD-2026-12285Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.3 (Medium severity) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), and requirement for authenticated access (PR:L). However, multiple risk signals elevate real-world concern: (1) Public exploit availability (E:P) significantly increases exploitation probability; (2) Authentication requirement (PR:L) reduces attack surface but does not eliminate risk—many D-Link NAS devices have default credentials or known account takeover paths; (3) Impact scope is unchanged (S:U) but affects confidentiality, integrity, and availability (C:L/I:L/A:L), limiting but not eliminating damage; (4) Reliability is reasonable (RC:R). The CVSS:3.1 vector correctly identifies this as medium-priority but exploitable. From an SSVC perspective: exploitation is proof-of-concept available (public), impact is limited to individual NAS instances but potentially includes RCE as root, and automatable exploitation is likely given CGI parameter manipulation. Real-world priority: HIGH for organizations running affected D-Link NAS models in networked environments, particularly in corporate/research settings where NAS devices are critical infrastructure. The requirement for authentication is mitigated by: (a) commonly weak default credentials on network devices, (b) LDAP/AD integration vulnerabilities that may grant unauthorized access, and (c) the fact that legitimate users with limited privileges can escalate. |
| Exploit ScenarioDerived | An attacker with valid credentials to a D-Link NAS management interface (obtained via credential stuffing, social engineering, or default credentials) navigates to the account management section. The attacker crafts a malicious HTTP request to /cgi-bin/account_mgr.cgi, injecting shell commands into a vulnerable parameter such as username, group name, or quota field. Example: submitting a username parameter like |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Command injection in D-Link NAS devices (DNS-120, DNS-325, DNR-322L, DNS-327L and others) allows authenticated remote attackers to execute arbitrary commands through multiple user and group management CGI functions. Public exploit code exists for this vulnerability, and patches are not currently available. An attacker with valid credentials could leverage this to compromise the NAS system and potentially access or manipulate stored data.
Earlier versions of this analysis (1)
A command injection vulnerability exists in D-Link network-attached storage (NAS) devices affecting the account management CGI interface (/cgi-bin/account_mgr.cgi). The vulnerability allows authenticated remote attackers to execute arbitrary system commands through multiple user and group management functions, potentially leading to unauthorized access, data manipulation, or system compromise. A public exploit is available, and the vulnerability affects 20 D-Link NAS models across their product lineup with firmware versions up to 20260205.
RemediationAI
No vendor patch is currently available based on provided intelligence. Immediate mitigation steps: (1) Restrict network access to the NAS device's web management interface (port 80/443) using firewall rules; limit access to trusted administrative IP addresses only; (2) Disable remote management and ensure the device is only accessible from the internal network; (3) Change default administrative credentials and enforce strong passwords; (4) Regularly audit access logs for suspicious CGI requests to /cgi-bin/account_mgr.cgi; (5) Monitor for parameters containing shell metacharacters (pipes, semicolons, backticks, command substitution syntax); (6) Implement network segmentation to isolate NAS devices; (7) Contact D-Link support to inquire about firmware updates—vendors typically do not release advisories for pre-disclosure vulnerabilities until patches are available. Workaround: Disable unnecessary user/group management features if not in active use. Long-term: Plan migration to NAS devices from vendors with stronger security track records and active patch cycles.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The affected component is the CGI script at /cgi-bin/account_mgr.cgi, which handles user and group account management operations. Vulnerable functions include: cgi_create_import_users, cgi_user_batch_create, cgi_user_set_quota, cgi_user_del, cgi_user_modify, cgi_group_set_quota, cgi_group_modify, cgi_group_add, cgi_user_add, cgi_get_modify_group_info, and cgi_chg_admin_pw. The root cause is insufficient input validation/sanitization when passing user-supplied parameters to system commands, allowing shell metacharacters to break out of intended command context. This affects D-Link NAS devices running embedded Linux operating systems that execute these CGI scripts via a web interface.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4209, a command injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in D-Link DNS NAS Command Injection Flaws
View all 11Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up t
Exploit-DB