Which versions of Dnr 202l are affected by CVE-2026-4210?

Organizations using A security flaw should be aware of moderate risk from CVE-2026-4210, a command injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4210?

Yes, a public proof-of-concept exploit is available for CVE-2026-4210. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-4210?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Dnr 202l CVE-2026-4210

Q: What is the CVSS score of CVE-2026-4210?

CVE-2026-4210 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-12283 LOW

Command Injection (CWE-77)

2026-03-16 VulDB

Command Injection D-Link Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 04:00 euvd

EUVD-2026-12283

Analysis Generated

Mar 16, 2026 - 04:00 vuln.today

CVE Published

Mar 16, 2026 - 03:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Command injection in D-Link NAS devices (DNS-320, DNS-327L, DNS-345 and others) through the time_machine.cgi script allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability resides in the cgi_tm_set_share function within /cgi-bin/time_machine.cgi, a CGI application handling Time Machine (macOS backup) share configuration on D-Link NAS appliances. The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command, aka 'Command Injection'). The affected products are NAS storage devices from D-Link's DNS and DNR product lines (CPE: cpe:3:a:d-link:dns-*:*:*:*:*:*:*:*:* and cpe:3:a:d-link:dnr-*:*:*:*:*:*:*:*:*), which are network-attached storage systems running embedded Linux with CGI-based web administration interfaces. The flaw permits an authenticated user to inject shell metacharacters into the 'Name' parameter, which is then passed unsanitized to system commands, allowing arbitrary command execution with the privileges of the web server process (typically root in embedded NAS appliances).

RemediationAI

Immediate remediation steps: (1) Check D-Link support website (https://www.dlink.com/) for available firmware updates newer than 20260205 for your specific NAS model; (2) Apply firmware patches when available; (3) Until patches are available, implement network-level mitigations: restrict access to the NAS web interface (port 80/443) to trusted networks only, use a firewall or VPN to limit CGI exposure; (4) Enforce strong authentication—change default credentials and mandate complex passwords for all NAS user accounts; (5) Disable the Time Machine sharing feature in the NAS administration panel if not in use; (6) Monitor for suspicious activity in NAS logs (attempts to access /cgi-bin/time_machine.cgi with unusual parameters); (7) Segment NAS devices from the public internet and limit inbound access to specific hosts. No official vendor advisory or patch timeline is currently available in references; contact D-Link support directly for patch availability and advisory details.