Which versions of Dnr 202l are affected by CVE-2026-5214?

CVE-2026-5214 is a stack-based buffer overflow affecting 21 D-Link NAS device models that allows authenticated users to execute arbitrary code with complete system compromise.

Is there a public PoC exploit available for CVE-2026-5214?

Yes, a public proof-of-concept exploit is available for CVE-2026-5214. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5214?

Within 24 hours: Identify all D-Link NAS models in use against the affected product list and isolate devices from untrusted networks or restrict account_mgr.cgi access via firewall rules. Within 7 days: Conduct access log review on affected devices for suspicious authentication patterns and implement network segmentation to limit lateral movement from compromised NAS systems. Within 30 days: Contact D-Link support for patch availability timeline; if no patch emerges, evaluate replacement or permanent air-gapping of affected devices depending on business criticality.

Dnr 202l CVE-2026-5214

Q: What is the CVSS score of CVE-2026-5214?

CVE-2026-5214 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17688 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-31 VulDB

GHSA-46rv-vf36-7m9j

Buffer Overflow D-Link Stack Overflow Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 02, 2026 - 17:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 21:31 euvd

EUVD-2026-17688

Analysis Generated

Mar 31, 2026 - 21:31 vuln.today

CVE Published

Mar 31, 2026 - 21:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_addgroup_get_group_quota_minsize of the file /cgi-bin/account_mgr.cgi. The manipulation of the argument Name results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute arbitrary code with high impact across 21 product models. The vulnerability resides in the cgi_addgroup_get_group_quota_minsize function within /cgi-bin/account_mgr.cgi, exploitable via malicious Name parameter input. Public exploit code exists on GitHub, significantly lowering the technical barrier for attacks. Authentication is required (PR:L), but once authenticated, attackers achieve full confidentiality, integrity, and availability compromise. EPSS and KEV status not provided, but the combination of public POC, network accessibility (AV:N), low complexity (AC:L), and widespread device deployment represents material risk to organizations using affected D-Link NAS products.

Technical ContextAI

This vulnerability affects the account management CGI interface in D-Link Network Attached Storage (NAS) devices, specifically targeting the cgi_addgroup_get_group_quota_minsize function responsible for processing group quota parameters. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), occurring when the application fails to validate the length of user-supplied data in the Name parameter before copying it to a fixed-size stack buffer. The affected CGI binary at /cgi-bin/account_mgr.cgi processes administrative account management requests, making it a privileged component. The vulnerability spans 21 distinct D-Link NAS product lines including DNS and DNR series devices, all sharing common firmware codebase or inherited vulnerable code patterns. Stack-based overflows are particularly dangerous because they can overwrite return addresses and function pointers on the call stack, enabling control-flow hijacking and arbitrary code execution in the context of the web server process, which typically runs with elevated privileges on embedded NAS devices.

RemediationAI

No vendor-released patch has been independently confirmed from the available data sources. Organizations operating affected D-Link NAS devices should immediately implement defense-in-depth controls: restrict access to the /cgi-bin/account_mgr.cgi interface to trusted management networks only using firewall rules or VLAN segmentation; disable internet-facing management interfaces entirely if remote administration is not operationally required; enforce strong, unique administrative passwords and disable default accounts; implement network intrusion detection signatures to identify exploitation attempts targeting the vulnerable CGI endpoint; and monitor authentication logs for suspicious account activity. Given the age of affected product lines and D-Link's historical approach to legacy device support, customers should evaluate migration to currently-supported NAS solutions with active security maintenance. Contact D-Link technical support directly to inquire about security update availability for your specific model and firmware version, referencing CVE-2026-5214. Consult the official D-Link security advisory page and the vulnerability disclosure at https://vuldb.com/vuln/354349 for any emerging remediation guidance.