Is there a public PoC exploit available for CVE-2026-5312?

Yes, a public proof-of-concept exploit is available for CVE-2026-5312. Prioritise patching immediately. EPSS: 0.1%.

D-Link CVE-2026-5312

Q: What is the CVSS score of CVE-2026-5312?

CVE-2026-5312 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18069 MEDIUM

Improper Access Control (CWE-284)

2026-04-01 VulDB

GHSA-mgj3-965m-6684

D-Link Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 15:42 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18069

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function FMT_restart/Status_HDInfo/SMART_List/ScanDisk_info/ScanDisk/volume_status/Get_Volume_Mapping/FMT_check_disk_remount_state/FMT_rebuildinfo/FMT_result_list/FMT_result_list_phy/FMT_get_dminfo/FMT_manually_rebuild_info/Get_current_raidtype of the file /cgi-bin/dsk_mgr.cgi. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up to 20260205) allow remote unauthenticated attackers to manipulate disk management functions via the /cgi-bin/dsk_mgr.cgi endpoint, resulting in availability impact. Publicly available exploit code exists and the vulnerability has moderate real-world exploitability (CVSS 5.5, EPSS probability indicated by E:P vector), requiring no authentication or user interaction for remote attack.

Technical ContextAI

The vulnerability resides in improper access control mechanisms (CWE-284) within the CGI-based disk management interface of D-Link NAS devices. Specifically, multiple functions in /cgi-bin/dsk_mgr.cgi-including FMT_restart, Status_HDInfo, SMART_List, ScanDisk_info, volume_status, FMT_check_disk_remount_state, FMT_rebuildinfo, and disk mapping/RAID configuration functions-fail to properly enforce authorization checks before processing user-supplied parameters. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms the attack surface is network-accessible without requiring authentication or special conditions, suggesting these endpoints lack authentication gates or implement flawed permission validation. The VA:L (availability impact) designation indicates attackers can manipulate disk operations, potentially causing service disruption or resource exhaustion rather than data exfiltration.

RemediationAI

Immediately update affected D-Link NAS devices to firmware versions released after 20260205. Check D-Link's official support website (https://www.dlink.com/) for the latest firmware builds for each affected model. As a temporary measure pending patch availability, restrict network access to the /cgi-bin/dsk_mgr.cgi endpoint by implementing firewall rules or network segmentation to allow only trusted administrative sources; disable remote management features if not required for operational needs. Verify that the device's web interface is not exposed to untrusted networks (e.g., the public internet or shared corporate networks). Monitor vendor advisories at https://vuldb.com/vuln/354641 for confirmed patch release dates and apply updates as soon as tested in your environment.