D-Link CVE-2026-5311

Q: What is the CVSS score of CVE-2026-5311?

CVE-2026-5311 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18023 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-04-01 cna@vuldb.com

GHSA-8c3r-vjwj-2gvx

D-Link Information Disclosure

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 20:27 euvd

EUVD-2026-18023

Analysis Generated

Apr 01, 2026 - 20:27 vuln.today

CVE Published

Apr 01, 2026 - 20:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Improper access controls in D-Link DNS and DNR series NAS devices allow unauthenticated remote attackers to manipulate the cmd argument in the Webdav_Access_List function via /cgi-bin/file_center.cgi, resulting in information disclosure with CVSS 5.5. Public exploit code is available, placing affected devices at immediate risk of unauthorized data access.

Technical ContextAI

The vulnerability resides in the CGI script /cgi-bin/file_center.cgi on D-Link network storage devices, specifically in the Webdav_Access_List function. The flaw is classified as CWE-266 (Incorrect Privilege Assignment), indicating that the access control mechanism fails to properly validate or restrict operations based on user privileges. By manipulating the cmd parameter, an attacker can bypass intended access restrictions on WebDAV-related functionality, which typically manages file sharing and remote access permissions. The affected devices are consumer and small-business NAS units spanning multiple generations (DNS-120 through DNS-1550-04), all running firmware dated up to 20260205 or earlier. The attack vector is entirely network-based with low attack complexity and no authentication requirement (PR:N per CVSS 4.0 vector), meaning the vulnerability is exploitable by any unauthenticated remote actor.

RemediationAI

D-Link users should check the vendor advisory at https://www.dlink.com/ for updated firmware releases addressing CVE-2026-5311. Apply the latest firmware version available for each affected model (any version after 20260205) to remediate the improper access control flaw. If firmware updates are not immediately available, restrict network access to affected NAS devices by disabling remote WebDAV access or implementing network-level filtering to prevent untrusted hosts from reaching the /cgi-bin/file_center.cgi endpoint. Organizations should prioritize patching devices that are internet-facing or accessible from untrusted networks, as the unauthenticated nature of the attack makes them primary targets for information disclosure.