What is the CVSS score of CVE-2026-4214?

CVE-2026-4214 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4214?

Yes, a public proof-of-concept exploit is available for CVE-2026-4214. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4214?

Within 24 hours: Inventory all D-Link DNS/DNR series devices and identify firmware versions up to 20260205; disable remote access to affected devices if business-critical alternatives exist. Within 7 days: Implement network segmentation to restrict NAS access to authorized personnel only, enable enhanced logging/monitoring on all identified devices, and establish a vendor communication protocol to track D-Link patch timelines. Within 30 days: Deploy compensating controls (see below); prepare migration or replacement strategy for high-risk devices; conduct security assessment of any systems that accessed affected NAS devices.

Dnr 202l CVE-2026-4214

EUVD-2026-12329 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-16 VulDB

Buffer Overflow D-Link Stack Overflow Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as valid user
Exploit

Send crafted request to /cgi-bin/app_mgr.cgi
Execution

Trigger stack buffer overflow in UPnP_AV_Server_Path_Setting
Impact

Execute arbitrary code with device privileges

Vulnerability Assessment

Weakness	CWE CWE-121 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Valid user credentials required for D-Link DNS/DNR NAS models (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) running firmware versions up to 20260205. UPnP_AV_Server_Path_Setting feature in /cgi-bin/app_mgr.cgi must be accessible.
Impact	The CVSS 3.1 score of 8.8 (High) indicates significant risk with network attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L). The exploit code maturity is marked as 'Proof-of-Concept' (E:P), confirming weaponization potential. While authentication is required (reducing opportunistic attacks), the combination of public exploit availability, remote exploitability, and potential for complete system compromise (C:H/I:H/A:H) makes this a high-priority vulnerability. No EPSS score or KEV listing is mentioned, suggesting limited observed exploitation in the wild currently, but the public POC significantly increases future exploitation likelihood.
Exploit ScenarioDerived	An attacker with low-privileged credentials (or compromised user account) can remotely send a specially crafted request to the /cgi-bin/app_mgr.cgi endpoint's UPnP_AV_Server_Path_Setting function, causing a stack buffer overflow. This allows arbitrary code execution with the privileges of the web service. The public exploit code at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_164/164.md provides implementation details. Attack scenarios include data theft, ransomware deployment, or using the NAS as a pivot point for lateral movement in the network.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

Stack-based buffer overflow in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-326, DNS-1100-4, and others) through the UPnP_AV_Server_Path_Setting function in /cgi-bin/app_mgr.cgi allows authenticated remote attackers to achieve complete system compromise with high integrity, confidentiality, and availability impact. Public exploit code exists for this vulnerability, and no patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 05:00 CVSS 8.8

A stack-based buffer overflow vulnerability exists in the UPnP_AV_Server_Path_Setting function of multiple D-Link NAS (Network Attached Storage) devices, allowing remote authenticated attackers to execute arbitrary code. The vulnerability affects over 20 D-Link DNS/DNR series storage devices up to firmware version 20260205, with a public exploit available on GitHub making active exploitation likely.

RemediationAI

No patch information is currently available in the provided references. The vendor website (https://www.dlink.com/) should be monitored for security advisories. As immediate mitigation: 1) Disable UPnP functionality if not required, 2) Restrict network access to the management interface, 3) Implement network segmentation to isolate NAS devices, 4) Monitor for suspicious activity on the affected /cgi-bin/app_mgr.cgi endpoint. Given the age and variety of affected models, some may be end-of-life without patch support.

Affected VersionsENISA

DNS-1200-05 20260205

DNS-343 20260205

DNS-320L 20260205

DNS-120 20260205

DNS-345 20260205

DNS-726-4 20260205

DNS-323 20260205

DNS-327L 20260205

DNS-325 20260205

DNR-202L 20260205

DNS-315L 20260205

DNS-320 20260205

DNS-1550-04 20260205

DNS-321 20260205

DNR-326 20260205

DNS-1100-4 20260205

DNS-340L 20260205

DNS-326 20260205

DNS-320LW 20260205

DNR-322L 20260205

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-121: Stack-based Buffer Overflow) occurs in the /cgi-bin/app_mgr.cgi file's UPnP_AV_Server_Path_Setting function across D-Link's DNS (ShareCenter) and DNR series NAS devices. The affected CPE entries confirm impact across models DNS-120, DNS-315L, DNS-320 series (including L/LW variants), DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04, DNR-202L, DNR-322L, and DNR-326. These are consumer and small business network storage appliances that provide UPnP media server functionality.

Know when Dnr 202l gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

CVE Published

Mar 16, 2026 - 04:32 nvd

HIGH 8.8

DescriptionCVE.org

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the file /cgi-bin/app_mgr.cgi. Executing a manipulation can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

Executive ViewAI

Why It Matters

D-Link NAS devices across our infrastructure face a critical remote code execution vulnerability with active exploitation already occurring in the wild. Any authenticated user-including compromised internal accounts-can gain complete control of affected storage systems, threatening data integrity, confidentiality, and availability across dependent business operations.

Business Impact: Severe

Compensating Controls

Network segmentation: Isolate NAS devices to trusted administrative VLANs only; 2) Disable UPnP_AV services if not required for business operations; 3) Restrict authentication mechanisms (disable legacy protocols, enforce strong MFA); 4) Deploy WAF/IDS rules to detect and block UPnP_AV_Server_Path_Setting function calls with suspicious payloads; 5) Implement real-time file integrity monitoring on NAS volumes; 6) Require VPN for all remote NAS access; 7) Monitor vendor advisories daily for patch availability; 8) Escalate to D-Link support for emergency firmware or hotfix availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.