D-Link DGS-3420 CVE-2026-7026

Q: What is the CVSS score of CVE-2026-7026?

CVE-2026-7026 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25701 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-26 VulDB

XSS D-Link

5.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 26, 2026 - 08:22 NVD

4.5 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 08:00 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 07:45 euvd

EUVD-2026-25701

Analysis Generated

Apr 26, 2026 - 07:45 vuln.today

CVE Published

Apr 26, 2026 - 07:15 nvd

MEDIUM 5.4

DescriptionCVE.org

A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processing of the component System Information Settings Page. This manipulation of the argument System Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stored or reflected cross-site scripting (XSS) in D-Link DGS-3420 firmware 1.50.018 allows authenticated remote attackers to inject malicious scripts via the System Name parameter on the System Information Settings Page. The vulnerability requires high-level administrative privileges and user interaction (UI:R), limiting exploitation to scenarios where an authenticated admin visits a malicious page or clicks a crafted link. Publicly available exploit code exists; CVSS 4.5 reflects the requirement for admin access and user interaction, though the impact is information disclosure or session hijacking potential through XSS.

Technical ContextAI

The vulnerability is a reflected or stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the System Information Settings Page component of D-Link DGS-3420 network switches. The System Name input parameter is not properly sanitized before being rendered in HTTP responses or stored in the web interface. Unlike network-based XSS requiring MIME sniffing or browser bugs, this attack leverages the switch's web management interface where administrators configure device settings. The CPE indicates all versions of the DGS-3420 product line are potentially affected, though version 1.50.018 is explicitly confirmed vulnerable.

RemediationAI

Upgrade D-Link DGS-3420 to the latest available firmware release beyond 1.50.018; consult D-Link support (www.dlink.com) for the specific patched version number, as it is not disclosed in the vulnerability sources. Until patching is possible, implement the following compensating controls: (1) restrict web management interface access to trusted administrative networks only using firewall rules or access control lists (trade-off: reduces remote management capability), (2) disable the System Information Settings Page feature if unused (verify with D-Link documentation for side effects on monitoring), (3) require multi-factor authentication for admin access if supported by the device (reduces social engineering risk), and (4) educate administrators to avoid clicking untrusted links while logged into the switch web interface. Monitor D-Link security advisories for confirmed patch releases.