Is there a public PoC exploit available for CVE-2026-5215?

Yes, a public proof-of-concept exploit is available for CVE-2026-5215. Prioritise patching immediately. EPSS: 0.0%.

Dnr 202l CVE-2026-5215

Q: What is the CVSS score of CVE-2026-5215?

CVE-2026-5215 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17689 LOW

Improper Access Control (CWE-284)

2026-03-31 VulDB

Authentication Bypass D-Link Dnr 202l Dnr 322l Dnr 326 Dns 1100 4 Dns 120 Dns 1200 05 Dns 1550 04 Dns 315l Dns 320 Dns 320l Dns 320lw Dns 321 Dns 323 Dns 325 Dns 326 Dns 327l Dns 340l Dns 343 Dns 345 Dns 726 4 D-Link

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 02, 2026 - 17:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 21:31 euvd

EUVD-2026-17689

Analysis Generated

Mar 31, 2026 - 21:31 vuln.today

CVE Published

Mar 31, 2026 - 21:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_get_ipv6 of the file /cgi-bin/network_mgr.cgi. Such manipulation leads to improper access controls. The exploit is publicly available and might be used.

AnalysisAI

Improper access controls in D-Link DNS and DNR network-attached storage devices allow unauthenticated remote attackers on adjacent networks to access IPv6 configuration functions via the cgi_get_ipv6 function in /cgi-bin/network_mgr.cgi, potentially disclosing sensitive network configuration information. The vulnerability affects multiple D-Link models up to firmware version 20260205, publicly available exploit code exists, and the attack requires only network adjacency with low complexity.

Technical ContextAI

The vulnerability resides in the CGI script handler for network management on D-Link DNS and DNR series network-attached storage (NAS) devices. The cgi_get_ipv6 function implements improper access controls (CWE-284: Improper Access Control) that fail to properly validate or restrict access to IPv6 network configuration parameters. The /cgi-bin/network_mgr.cgi endpoint is typically accessible over HTTP/HTTPS from the device's administrative interface. The weakness allows unauthenticated attackers positioned on the same adjacent network segment to bypass authentication mechanisms and read sensitive IPv6 configuration data, which may include network topology information, device settings, or other configuration details useful for further reconnaissance or attack planning.

RemediationAI

Contact D-Link support to obtain firmware updates addressing the improper access control in network_mgr.cgi, targeting firmware versions released after 20260205. Immediate mitigation steps include restricting network access to the device's HTTP/HTTPS management interface using firewall rules or network segmentation-limit access to the /cgi-bin/network_mgr.cgi endpoint to trusted administrative networks only. If the device supports administrative access controls, verify that access restrictions are properly enforced. Disable remote management over WAN if not required, and ensure the device is not directly exposed to untrusted network segments. Monitor D-Link's official support portal (https://www.dlink.com/) for security advisories and patched firmware releases. Until patches are available, implement network-level protections such as requiring VPN access to reach the device management interface.