CVSS 4.0
2.1 lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVE-2026-4209
A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 6.6% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-77, CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlink:dnr-202l_firmware
- dlink:dnr-326_firmware
- dlink:dns-1100-4_firmware
- dlink:dns-1200-05_firmware
- dlink:dns-120_firmware
- dlink:dns-1550-04_firmware
- dlink:dns-315l_firmware
- dlink:dns-320_firmware
- dlink:dns-320l_firmware
- dlink:dns-320lw_firmware
- dlink:dns-321_firmware
- dlink:dns-322l_firmware
- dlink:dns-323_firmware
- dlink:dns-325_firmware
- dlink:dns-326_firmware
- dlink:dns-327l_firmware
- dlink:dns-340l_firmware
- dlink:dns-343_firmware
- dlink:dns-345_firmware
- dlink:dns-726-4_firmware