EUVD-2026-12284Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link NAS device
-
ExploitSend crafted request to /cgi-bin/local_backup_mgr.cgi
-
ExecutionOverflow stack buffer via f_idx parameter
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid login credentials to D-Link NAS (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) running firmware version prior to 20260205; requires network access to CGI script. |
| Impact | This vulnerability presents a severe real-world risk based on multiple factors: The CVSS score of 8.8 (High) reflects network-accessible attack vector with low complexity and low privilege requirements. The existence of a public POC exploit on GitHub significantly increases the threat level. While not currently listed in CISA KEV, the combination of widespread affected products, remote exploitability, and available exploit code makes this a priority for immediate patching. The attack requires only low-level authentication, making it exploitable by any user with basic access to the device's web interface. |
| Exploit ScenarioDerived | An attacker with low-level credentials (such as a guest user account) can send a specially crafted HTTP request to the /cgi-bin/local_backup_mgr.cgi endpoint with a malicious 'f_idx' parameter value. This triggers a buffer overflow that corrupts the stack, potentially allowing the attacker to execute arbitrary code on the device. Given the public POC availability at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_160/160.md, attackers can easily weaponize this vulnerability to gain full control over the NAS device, access stored data, or use it as a pivot point for further network attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Stack-based buffer overflow in D-Link DNS and DNR network storage devices allows authenticated remote attackers to execute arbitrary code by manipulating the f_idx parameter in the local_backup_mgr.cgi endpoint. Public exploit code exists for this vulnerability, which affects multiple device models up to firmware version 20260205 with no patch currently available. An attacker with valid credentials can trigger memory corruption to achieve complete system compromise including code execution, data theft, and service disruption.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the Local_Backup_Info function of multiple D-Link NAS (Network Attached Storage) devices, allowing remote attackers with low privileges to achieve complete system compromise. The vulnerability affects 20 different D-Link DNS/DNR models running firmware versions up to 20260205, and a public proof-of-concept exploit is already available, making this a high-priority issue for affected organizations.
RemediationAI
No patch information is currently available in the provided references. Organizations should immediately check D-Link's official support page (https://www.dlink.com/) for firmware updates. As an interim mitigation, restrict network access to the affected devices' management interfaces, ensuring they are not exposed to the internet. Implement strong authentication and limit user accounts with access to the backup management functionality. Monitor for suspicious activity in device logs, particularly around the local_backup_mgr.cgi endpoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-121: Stack-based Buffer Overflow) occurs in the /cgi-bin/local_backup_mgr.cgi file where improper handling of the 'f_idx' parameter causes memory corruption. The affected products are D-Link's DNS (ShareCenter) and DNR series NAS devices, which are consumer and small business network storage solutions. These devices typically run embedded Linux with web-based management interfaces. The buffer overflow allows attackers to overwrite stack memory, potentially leading to arbitrary code execution with the privileges of the web server process.
Know when Dnr 202l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this issue is the function Local_Backup_Info of the file /cgi-bin/local_backup_mgr.cgi. This manipulation of the argument f_idx causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
D-Link NAS devices across 20 models are vulnerable to a critical remote attack that could allow attackers to completely compromise affected systems without requiring high-level privileges. Organizations using these devices face immediate risk of data breach, ransomware deployment, and operational disruption, especially since exploit code is publicly available and no patch has been released.
Disable remote access to the Local_Backup_Info function and restrict NAS administration to internal networks only via firewall rules. Implement network segmentation isolating NAS devices from untrusted networks. Deploy Web Application Firewall (WAF) rules to detect and block buffer overflow exploitation attempts. Enable comprehensive logging and monitoring on affected NAS devices. Restrict user account privileges to minimum necessary levels. Consider implementing intrusion prevention system (IPS) signatures specific to CVE-2026-4211. If feasible, take affected devices offline until a patch is available or replacement hardware is procured.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in D-Link DNS NAS Command Injection Flaws
View all 11Stack-based buffer overflow in D-Link NAS devices enables authenticated remote attackers to execute arbitrary code with
Stack-based buffer overflow in D-Link NAS device management interfaces allows authenticated remote attackers to execute
Stack-based buffer overflow in D-Link NAS devices allows authenticated remote attackers to achieve complete system compr
Stack-based buffer overflow in D-Link NAS devices enables remote code execution with high integrity impact for authentic
Improper access controls in D-Link network-attached storage devices (DNS-120 through DNS-1550-04, firmware versions up t
Exploit-DB