Which versions of Dnr 202l are affected by CVE-2026-5212?

D-Link NAS devices (DNS and DNR models through firmware 20260205) contain a stack-based buffer overflow in the WebDAV management interface that allows authenticated users to gain complete system…

Is there a public PoC exploit available for CVE-2026-5212?

Yes, a public proof-of-concept exploit is available for CVE-2026-5212. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5212?

Within 24 hours: Inventory all D-Link DNS and DNR NAS devices in production; verify firmware versions against 20260205 baseline and identify which models are affected per vendor's published vulnerability scope. Within 7 days: Implement network segmentation to restrict WebDAV management access (/cgi-bin/webdav_mgr.cgi) to trusted administrative networks only; disable WebDAV entirely if not operationally required. Within 30 days: Develop a hardware replacement plan for affected end-of-life devices; prioritize migration to vendor-supported NAS solutions with active security patching; document any devices that cannot be immediately replaced and apply compensating controls.

Dnr 202l CVE-2026-5212

Q: What is the CVSS score of CVE-2026-5212?

CVE-2026-5212 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17662 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-31 VulDB

GHSA-42h9-h8r4-fwqg

Buffer Overflow D-Link Stack Overflow Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 17:15 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 20:31 euvd

EUVD-2026-17662

Analysis Generated

Mar 31, 2026 - 20:31 vuln.today

CVE Published

Mar 31, 2026 - 20:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function Webdav_Upload_File of the file /cgi-bin/webdav_mgr.cgi. The manipulation of the argument f_file leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Articles & Coverage 1

vuln.today Threat Landscape 30/03-06/04/2026: Chrome Zero-Day, TrueConf Supply Chain, ShareFile Kill Chain Apr 06, 2026

AnalysisAI

Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with full system privileges. Affecting 20+ end-of-life D-Link DNS and DNR network storage models through firmware version 20260205, the flaw resides in the Webdav_Upload_File function within /cgi-bin/webdav_mgr.cgi. Publicly available exploit code exists, significantly lowering the barrier to exploitation. CVSS 8.8 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. Organizations using these legacy devices face immediate risk of complete confidentiality, integrity, and availability compromise.