What is the CVSS score of CVE-2026-4212?

CVE-2026-4212 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dns 1550 04 are affected by CVE-2026-4212?

D-Link NAS devices across our infrastructure are vulnerable to a critical stack-based buffer overflow (CVE-2026-4212) that allows authenticated attackers to fully compromise affected systems.

Is there a public PoC exploit available for CVE-2026-4212?

Yes, a public proof-of-concept exploit is available for CVE-2026-4212. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4212?

Within 24 hours: Inventory all D-Link NAS devices in production and identify which models are affected; isolate affected devices from untrusted networks and restrict admin access. Within 7 days: Implement network segmentation to limit NAS access to authorized users only, disable remote management protocols where possible, and deploy WAF/IPS rules to block exploitation attempts. Within 30 days: Evaluate replacement with patched firmware versions when available, migrate critical data to unaffected storage systems if feasible, and establish a vendor communication channel for patch release timelines.

Dns 1550 04 CVE-2026-4212

EUVD-2026-12286 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-16 VulDB

D-Link Buffer Overflow Stack Overflow Dns 1550 04 Dns 343 Dns 726 4 Dns 325 Dns 1100 4 Dns 1200 05 Dns 120 Dns 340l Dns 320lw Dns 315l Dns 320 Dns 323 Dns 320l Dnr 202l Dns 327l Dnr 326 Dnr 322l Dns 321 Dns 345 Dns 326

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 04:00 euvd

EUVD-2026-12286

Analysis Generated

Mar 16, 2026 - 04:00 vuln.today

CVE Published

Mar 16, 2026 - 03:32 nvd

HIGH 8.8

DescriptionCVE.org

A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function Downloads_Schedule_Info of the file /cgi-bin/download_mgr.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to achieve remote code execution via the Downloads_Schedule_Info function in /cgi-bin/download_mgr.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed over the network with high impact on confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects a wide range of D-Link DNS (D-Link Network Storage) and DNR (D-Link Network Recorder) devices, including models DNS-120 through DNS-1550-04. The flaw is a classic stack-based buffer overflow (CWE-121) in the download manager CGI script. When processing user-supplied input in the Downloads_Schedule_Info function, the application fails to properly validate buffer boundaries, allowing an attacker to overwrite stack memory. This can lead to arbitrary code execution with the privileges of the web server process. All affected devices running firmware versions up to 20260205 are vulnerable.

RemediationAI

No specific patch information is available in the provided references. The vendor link (https://www.dlink.com/) should be monitored for security advisories. Immediate mitigation steps include: (1) Restrict network access to the management interface using firewall rules; (2) Disable remote management features if not required; (3) Place affected devices behind a VPN or restrict access to trusted IP addresses only; (4) Monitor devices for suspicious activity in download manager logs. Contact D-Link support for firmware update availability beyond version 20260205.