EUVD-2026-18069
GHSA-mgj3-965m-6684
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.5 is moderate, multiple risk signals elevate real-world concern: (1) publicly available exploit code (E:P in vector, confirmed by GitHub references) lowers the barrier to weaponization; (2) attack vector is network-accessible with no authentication (AV:N/PR:N), enabling remote exploitation from untrusted networks; (3) attack complexity is low (AC:L), requiring no special conditions or timing; (4) the vulnerability affects an extensive range of D-Link NAS models spanning multiple product lines (DNS-120 through DNS-1550-04), suggesting broad deployment in small-business and prosumer environments; (5) the attack targets administrative functions (disk management, RAID rebuild, formatting checks), which, while constrained to availability impact in the formal CVSS vector, could facilitate further compromise if chained with other vulnerabilities. However, the confined scope (availability only, not confidentiality or integrity) and lack of CISA KEV confirmation suggest this is a moderate-priority issue rather than critical infrastructure threat. Organizations with exposed D-Link NAS devices on untrusted networks should prioritize patching, but this does not represent an immediate supply-chain or widespread active-exploitation crisis. |
| Exploit ScenarioDerived | An attacker on an untrusted network (e.g., the Internet or a compromised internal segment) sends a crafted HTTP request to the vulnerable /cgi-bin/dsk_mgr.cgi endpoint of an internet-facing D-Link NAS device, manipulating parameters for functions such as FMT_restart or ScanDisk without providing authentication credentials. The lack of proper access control allows the request to be processed, triggering unintended disk operations (e.g., initiating a disk check, restarting format operations, or triggering a RAID rebuild). The attacker repeats this attack to disrupt service availability or corrupt data, using publicly available proof-of-concept code from GitHub to automate exploitation across multiple target devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up to 20260205) allow remote unauthenticated attackers to manipulate disk management functions via the /cgi-bin/dsk_mgr.cgi endpoint, resulting in availability impact. Publicly available exploit code exists and the vulnerability has moderate real-world exploitability (CVSS 5.5, EPSS probability indicated by E:P vector), requiring no authentication or user interaction for remote attack.
RemediationAI
Immediately update affected D-Link NAS devices to firmware versions released after 20260205. Check D-Link's official support website (https://www.dlink.com/) for the latest firmware builds for each affected model. As a temporary measure pending patch availability, restrict network access to the /cgi-bin/dsk_mgr.cgi endpoint by implementing firewall rules or network segmentation to allow only trusted administrative sources; disable remote management features if not required for operational needs. Verify that the device's web interface is not exposed to untrusted networks (e.g., the public internet or shared corporate networks). Monitor vendor advisories at https://vuldb.com/vuln/354641 for confirmed patch release dates and apply updates as soon as tested in your environment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in improper access control mechanisms (CWE-284) within the CGI-based disk management interface of D-Link NAS devices. Specifically, multiple functions in /cgi-bin/dsk_mgr.cgi-including FMT_restart, Status_HDInfo, SMART_List, ScanDisk_info, volume_status, FMT_check_disk_remount_state, FMT_rebuildinfo, and disk mapping/RAID configuration functions-fail to properly enforce authorization checks before processing user-supplied parameters. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms the attack surface is network-accessible without requiring authentication or special conditions, suggesting these endpoints lack authentication gates or implement flawed permission validation. The VA:L (availability impact) designation indicates attackers can manipulate disk operations, potentially causing service disruption or resource exhaustion rather than data exfiltration.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function FMT_restart/Status_HDInfo/SMART_List/ScanDisk_info/ScanDisk/volume_status/Get_Volume_Mapping/FMT_check_disk_remount_state/FMT_rebuildinfo/FMT_result_list/FMT_result_list_phy/FMT_get_dminfo/FMT_manually_rebuild_info/Get_current_raidtype of the file /cgi-bin/dsk_mgr.cgi. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cg
Stack-based buffer overflow in D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320 series, DNS-326, DNS-1100-4, and
Stack-based buffer overflow in D-Link DNS NAS devices (DNS-120 through DNS-1550-04) allows authenticated attackers to ac
Stack-based buffer overflow in D-Link DNS and DNR network storage devices allows authenticated remote attackers to execu
Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Command injection in D-Link NAS devices (DNS-320, DNS-327L, DNS-345 and others) through the time_machine.cgi script allo
A security vulnerability in A flaw (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
Exploit-DB