CVE-2026-7026: Cross Site Scripting in D-Link DGS-3420
CVE-2026-7026 is a cross-site scripting (XSS) vulnerability in the D-Link DGS-3420 device, specifically in version 1. 50. 018. The issue arises from improper handling of the System Name argument on the System Information Settings Page, allowing remote attackers to inject malicious scripts. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. The vulnerability has a medium severity rating with a CVSS score of 6. 8.
AI Analysis
Technical Summary
This vulnerability affects D-Link DGS-3420 version 1.50.018 and involves improper input validation on the System Information Settings Page, where manipulation of the System Name parameter can lead to cross-site scripting (CWE-79). The vulnerability allows remote attackers to execute scripts in the context of the affected device's web interface. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity and availability. No official patch or remediation guidance is currently available.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the device's web management interface, potentially leading to unauthorized actions or information disclosure. The impact affects the integrity and availability of the device's management functions. However, there are no confirmed reports of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit access to the device's management interface to trusted networks and users, and consider disabling remote management if not required.
CVE-2026-7026: Cross Site Scripting in D-Link DGS-3420
Description
CVE-2026-7026 is a cross-site scripting (XSS) vulnerability in the D-Link DGS-3420 device, specifically in version 1. 50. 018. The issue arises from improper handling of the System Name argument on the System Information Settings Page, allowing remote attackers to inject malicious scripts. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. The vulnerability has a medium severity rating with a CVSS score of 6. 8.
CVSS v4.0
Score 6.8medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects D-Link DGS-3420 version 1.50.018 and involves improper input validation on the System Information Settings Page, where manipulation of the System Name parameter can lead to cross-site scripting (CWE-79). The vulnerability allows remote attackers to execute scripts in the context of the affected device's web interface. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity and availability. No official patch or remediation guidance is currently available.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the device's web management interface, potentially leading to unauthorized actions or information disclosure. The impact affects the integrity and availability of the device's management functions. However, there are no confirmed reports of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit access to the device's management interface to trusted networks and users, and consider disabling remote management if not required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-25T14:13:55.932Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Epss Score
- 0.00039
- Epss Percentile
- 0.11483
- Epss Date
- 2026-04-26
- Gcve Source
- db.gcve.eu
Threat ID: 69edbd2687115cfb68d77b18
Added to database: 4/26/2026, 7:22:14 AM
Last enriched: 5/4/2026, 7:28:08 AM
Last updated: 6/10/2026, 3:20:22 AM
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.