Which versions of Dnr 202l are affected by CVE-2026-4209?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4209, a command injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4209?

Yes, a public proof-of-concept exploit is available for CVE-2026-4209. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-4209?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Dnr 202l CVE-2026-4209

Q: What is the CVSS score of CVE-2026-4209?

CVE-2026-4209 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-12285 LOW

Command Injection (CWE-77)

2026-03-16 VulDB

Command Injection D-Link Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 04:00 euvd

EUVD-2026-12285

Analysis Generated

Mar 16, 2026 - 04:00 vuln.today

CVE Published

Mar 16, 2026 - 02:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Command injection in D-Link NAS devices (DNS-120, DNS-325, DNR-322L, DNS-327L and others) allows authenticated remote attackers to execute arbitrary commands through multiple user and group management CGI functions. Public exploit code exists for this vulnerability, and patches are not currently available. An attacker with valid credentials could leverage this to compromise the NAS system and potentially access or manipulate stored data.

Technical ContextAI

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The affected component is the CGI script at /cgi-bin/account_mgr.cgi, which handles user and group account management operations. Vulnerable functions include: cgi_create_import_users, cgi_user_batch_create, cgi_user_set_quota, cgi_user_del, cgi_user_modify, cgi_group_set_quota, cgi_group_modify, cgi_group_add, cgi_user_add, cgi_get_modify_group_info, and cgi_chg_admin_pw. The root cause is insufficient input validation/sanitization when passing user-supplied parameters to system commands, allowing shell metacharacters to break out of intended command context. This affects D-Link NAS devices running embedded Linux operating systems that execute these CGI scripts via a web interface.

RemediationAI

No vendor patch is currently available based on provided intelligence. Immediate mitigation steps: (1) Restrict network access to the NAS device's web management interface (port 80/443) using firewall rules; limit access to trusted administrative IP addresses only; (2) Disable remote management and ensure the device is only accessible from the internal network; (3) Change default administrative credentials and enforce strong passwords; (4) Regularly audit access logs for suspicious CGI requests to /cgi-bin/account_mgr.cgi; (5) Monitor for parameters containing shell metacharacters (pipes, semicolons, backticks, command substitution syntax); (6) Implement network segmentation to isolate NAS devices; (7) Contact D-Link support to inquire about firmware updates—vendors typically do not release advisories for pre-disclosure vulnerabilities until patches are available. Workaround: Disable unnecessary user/group management features if not in active use. Long-term: Plan migration to NAS devices from vendors with stronger security track records and active patch cycles.