Which versions of D-Link are affected by CVE-2026-5213?

D-Link NAS devices (DNS and DNR series) contain a stack-based buffer overflow in the account_mgr.cgi component that allows authenticated users to execute arbitrary code and achieve complete system…

Is there a public PoC exploit available for CVE-2026-5213?

Yes, a public proof-of-concept exploit is available for CVE-2026-5213. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5213?

Within 24 hours: Inventory all D-Link DNS and DNR series NAS devices in your environment and document firmware versions; restrict network access to NAS management interfaces using firewall rules limiting access to administrative personnel only. Within 7 days: Contact D-Link support to confirm patch availability timeline and evaluate temporary isolation of affected devices from production networks if mission-critical alternatives exist. Within 30 days: Apply vendor-released firmware patches immediately upon availability; if no patch is released by day 30, execute segmentation strategy isolating NAS devices on restricted VLANs with multi-factor authentication enforced for all administrative access.

D-Link CVE-2026-5213

Q: What is the CVSS score of CVE-2026-5213?

CVE-2026-5213 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17663 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-31 VulDB

GHSA-rgch-x4h6-m876

D-Link Stack Overflow Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 17:15 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 20:31 euvd

EUVD-2026-17663

Analysis Generated

Mar 31, 2026 - 20:31 vuln.today

CVE Published

Mar 31, 2026 - 20:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compromise with high-confidence exploitation. Affects 20+ D-Link DNS and DNR series network storage products through firmware versions released until February 5, 2026. Publicly available exploit code exists targeting the account_mgr.cgi component, enabling remote code execution with low attack complexity once authenticated. CVSS 8.8 (High) with confirmed proof-of-concept demonstrates practical exploitability despite requiring low-privilege authentication.

Technical ContextAI

The vulnerability resides in the cgi_adduser_to_session function within /cgi-bin/account_mgr.cgi, a CGI-based account management interface common to D-Link's network-attached storage product line. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring when the read_list parameter is processed without proper bounds checking. When oversized input is supplied to this argument, user-controlled data overwrites adjacent stack memory, enabling arbitrary code execution. This affects the web management interface authentication subsystem across multiple product generations including DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 models. The CGI architecture's direct memory manipulation without modern protections makes classic stack overflow exploitation viable.

RemediationAI

Organizations should immediately check for firmware updates from D-Link's official support portal at https://www.dlink.com/ for their specific device models. Patch availability per vendor advisory should be verified for each affected model, as many devices may be end-of-life products no longer receiving security updates. If vendor-released patches are unavailable for legacy devices, implement network-level mitigations: isolate affected NAS devices on segmented VLANs with strict firewall rules, disable web management interface remote access, restrict administrative access to trusted IP addresses only, enforce strong credential policies eliminating default passwords, and consider migrating data to supported hardware. Monitor authentication logs for suspicious account_mgr.cgi access patterns and failed login attempts. Given the public exploit availability, exploitation attempts may occur, making compensating controls critical when patches are unavailable. For business-critical deployments on end-of-life hardware, plan immediate hardware replacement with currently supported storage solutions.