CVSS 4.0
2.1 lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVE-2026-4205
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-77, CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlink:dnr-202l_firmware
- dlink:dnr-326_firmware
- dlink:dns-1100-4_firmware
- dlink:dns-1200-05_firmware
- dlink:dns-120_firmware
- dlink:dns-1550-04_firmware
- dlink:dns-315l_firmware
- dlink:dns-320_firmware
- dlink:dns-320l_firmware
- dlink:dns-320lw_firmware
- dlink:dns-321_firmware
- dlink:dns-322l_firmware
- dlink:dns-323_firmware
- dlink:dns-325_firmware
- dlink:dns-326_firmware
- dlink:dns-327l_firmware
- dlink:dns-340l_firmware
- dlink:dns-343_firmware
- dlink:dns-345_firmware
- dlink:dns-726-4_firmware