Which versions of D-Link are affected by CVE-2026-5211?

CVE-2026-5211 affects up to 20 legacy D-Link NAS models through firmware 20260205, enabling authenticated attackers to execute arbitrary code remotely with high integrity impact via a stack buffer…

Is there a public PoC exploit available for CVE-2026-5211?

Yes, a public proof-of-concept exploit is available for CVE-2026-5211. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5211?

Within 24 hours: Inventory all D-Link NAS devices in production, identify affected models/firmware versions (up to 20260205), and document network access points and data sensitivity. Within 7 days: Restrict network access to affected NAS devices via firewall rules, disable UPnP services if not required, and enforce strong authentication (disable default credentials). Within 30 days: Evaluate replacement with supported hardware or decommission end-of-life devices; if retention is mandatory, implement network segmentation and continuous monitoring for suspicious UPnP traffic to /cgi-bin/app_mgr.cgi.

D-Link CVE-2026-5211

Q: What is the CVSS score of CVE-2026-5211?

CVE-2026-5211 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17613 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-31 VulDB

D-Link Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 17:14 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17613

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 19:30 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function UPnP_AV_Server_Path_Del of the file /cgi-bin/app_mgr.cgi. Executing a manipulation of the argument f_dir can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authenticated users. The vulnerability resides in the UPnP_AV_Server_Path_Del function within /cgi-bin/app_mgr.cgi, exploitable via manipulation of the f_dir parameter. With CVSS 8.8 (High), low attack complexity (AC:L), network accessibility (AV:N), and publicly available exploit code, this represents an elevated threat to approximately 20 legacy D-Link NAS models through firmware versions up to 20260205. No vendor-released patch identified at time of analysis, and many affected models appear to be end-of-life products.

Technical ContextAI

This vulnerability (CWE-121: Stack-based Buffer Overflow) affects the Common Gateway Interface (CGI) web management interface of D-Link Network Attached Storage (NAS) devices. The flaw exists in the UPnP Audio/Video server path deletion handler, where insufficient input validation on the f_dir parameter allows attackers to write beyond allocated stack memory boundaries. Stack-based buffer overflows are particularly dangerous in embedded device CGI scripts because they can overwrite return addresses and function pointers, enabling arbitrary code execution in the context of the web server process, which typically runs with elevated privileges on NAS firmware. The affected CPE strings indicate vulnerability spans consumer and small-business NAS product lines including single-bay (DNS-120, DNS-320 series) through enterprise four-bay models (DNS-1550-04), suggesting a common vulnerable codebase shared across D-Link's NAS firmware generations. The CGI script location (/cgi-bin/app_mgr.cgi) indicates this is a core management function accessible through the administrative web interface.

RemediationAI

No vendor-released patch identified at time of analysis for CVE-2026-5211 across affected D-Link NAS models. Organizations should immediately verify if their D-Link NAS devices fall within the affected product list and check D-Link's official support pages for end-of-life status and any forthcoming security updates. Interim risk mitigation measures include restricting web management interface access to trusted administrative networks only (disable remote access, implement firewall rules blocking external access to TCP ports 80/443 on NAS devices), enforcing strong unique passwords for all NAS accounts, disabling UPnP services if not operationally required, and monitoring authentication logs for suspicious login attempts. Given the likelihood that many affected models are end-of-life, organizations should prioritize migration to currently supported NAS solutions with active security maintenance. Network segmentation isolating NAS devices from critical systems and internet exposure provides defense-in-depth. Additional details available through VulDB references at https://vuldb.com/vuln/354347 and exploit documentation at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_165/165.md.