EUVD-2026-12286Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link NAS device
-
ExploitSend crafted request to /cgi-bin/download_mgr.cgi
-
ExecutionTrigger stack overflow in Downloads_Schedule_Info function
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Valid user credentials required for D-Link NAS models (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) running firmware versions up to 20260205 with download_mgr.cgi enabled. |
| Impact | This represents a HIGH real-world risk based on multiple factors: (1) The CVSS vector shows network-accessible (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L), making it easily exploitable; (2) A public proof-of-concept exists on GitHub, lowering the barrier for exploitation; (3) The exploit code existence (E:P) indicates active development of attack tools; (4) While not currently in CISA KEV, the combination of public exploit + network accessibility + full system impact makes this a priority for patching. The EPSS data is not available, but given the public exploit availability, the exploitation probability is likely elevated. This is a genuine high-risk issue, not just a theoretical vulnerability. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials (or who has obtained them through password reuse/default credentials) can remotely access the device's web interface and send a specially crafted request to /cgi-bin/download_mgr.cgi with an oversized parameter to the Downloads_Schedule_Info function. This triggers the buffer overflow, potentially allowing the attacker to execute arbitrary code and gain full control of the NAS device. Given that exploit code is publicly available at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_161/161.md, even low-skilled attackers can leverage this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to achieve remote code execution via the Downloads_Schedule_Info function in /cgi-bin/download_mgr.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed over the network with high impact on confidentiality, integrity, and availability.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the Downloads_Schedule_Info function of /cgi-bin/download_mgr.cgi affecting multiple D-Link NAS (Network Attached Storage) devices. The vulnerability allows authenticated remote attackers to achieve full system compromise (high impact to confidentiality, integrity, and availability) with a CVSS score of 8.8. A public proof-of-concept exploit is available on GitHub, significantly increasing the risk of exploitation.
RemediationAI
No specific patch information is available in the provided references. The vendor link (https://www.dlink.com/) should be monitored for security advisories. Immediate mitigation steps include: (1) Restrict network access to the management interface using firewall rules; (2) Disable remote management features if not required; (3) Place affected devices behind a VPN or restrict access to trusted IP addresses only; (4) Monitor devices for suspicious activity in download manager logs. Contact D-Link support for firmware update availability beyond version 20260205.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects a wide range of D-Link DNS (D-Link Network Storage) and DNR (D-Link Network Recorder) devices, including models DNS-120 through DNS-1550-04. The flaw is a classic stack-based buffer overflow (CWE-121) in the download manager CGI script. When processing user-supplied input in the Downloads_Schedule_Info function, the application fails to properly validate buffer boundaries, allowing an attacker to overwrite stack memory. This can lead to arbitrary code execution with the privileges of the web server process. All affected devices running firmware versions up to 20260205 are vulnerable.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function Downloads_Schedule_Info of the file /cgi-bin/download_mgr.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
D-Link NAS devices across our infrastructure are vulnerable to a critical stack-based buffer overflow (CVE-2026-4212) that allows authenticated attackers to fully compromise affected systems. With a public exploit already available and no vendor patch released, immediate action is required to prevent potential data theft, system takeover, and operational disruption of our network storage infrastructure.
Implement network segmentation and firewall rules restricting access to /cgi-bin/download_mgr.cgi to trusted IP ranges only; disable the Downloads_Schedule_Info function if not operationally required; enforce strict authentication controls and monitor admin account activity; deploy IPS/WAF rules to detect and block buffer overflow payloads; disable remote access to affected NAS devices and enforce VPN requirement for administration; monitor vendor security advisories daily for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in D-Link DNS NAS Command Injection Flaws
View all 11Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up t
Exploit-DB