A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_device/cgi_sms_test/cgi_firmware_upload/cgi_ntp_time of the file /cgi-bin/system_mgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function FMT_rebuild_diskmgr/FMT_create_diskmgr/ScanDisk_run_e2fsck of the file /cgi-bin/dsk_mgr.cgi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_myfavorite_add/cgi_myfavorite_set/cgi_myfavorite_del/cgi_myfavorite_set_sort_info/cgi_myfavorite_remove_apkg/cgi_myfavorite_compare_apkg/cgi_mycloud_auto_downlaod of the file /cgi-bin/gui_mgr.cgi. This manipulation of the argument f_user causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-4197 is a command injection vulnerability affecting multiple D-Link NAS devices, including the DNS-120 and various other models. The flaw exists in the /cgi-bin/download_mgr.cgi script, specifically in functions handling RSS feed updates and downloads. An attacker can remotely exploit this vulnerability without authentication or user interaction, injecting arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although no public exploits are currently known in the wild, the exploit code has been made public, increasing the risk of future attacks. Successful exploitation could lead to unauthorized command execution, potentially compromising device integrity and availability. Organizations using affected D-Link NAS devices should prioritize patching or applying mitigations to prevent exploitation.
CVE-2026-4196 is a command injection vulnerability affecting multiple D-Link network-attached storage (NAS) devices, including the DNS-120 and several other models. The flaw exists in the /cgi-bin/remote_backup.cgi script, specifically in functions handling remote backup and scheduling operations. An attacker can remotely exploit this vulnerability without authentication or user interaction to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with low complexity and no privileges required. Although no public exploits are currently known in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Organizations using affected D-Link NAS devices should prioritize patching or apply mitigations to prevent remote command execution. This vulnerability poses risks to confidentiality, integrity, and availability of data stored on these devices.
CVE-2026-4195 is a medium severity command injection vulnerability affecting multiple D-Link DNS series devices, including DNS-120 and others, up to firmware version 20260205. The flaw exists in an unspecified function within the /cgi-bin/wizard_mgr.cgi file, allowing remote attackers to execute arbitrary commands without authentication or user interaction. Although the exploit code has been published, no known widespread exploitation has been reported yet. The vulnerability impacts confidentiality, integrity, and availability due to potential full system compromise. Organizations using affected D-Link NAS and network devices are at risk, especially if devices are exposed to untrusted networks. Mitigation requires applying vendor patches once available or restricting access to the management interface. Countries with significant D-Link device usage and strategic reliance on these devices are at higher risk. Due to the medium CVSS score and remote exploitation capability without authentication, timely remediation is critical to prevent potential attacks.
CVE-2026-4194 is a medium severity vulnerability affecting multiple D-Link NAS devices, including the DNS-120 and various other models. The flaw exists in the cgi_set_wto function within the /cgi-bin/system_mgr.cgi file, leading to improper access controls. This vulnerability allows remote attackers to manipulate the system without authentication or user interaction. The exploit is publicly available, increasing the risk of exploitation. Although no known exploits are currently observed in the wild, the vulnerability could potentially allow unauthorized access or modification of device settings. The CVSS 4.0 score is 6.9, reflecting a moderate risk due to ease of exploitation and impact on confidentiality, integrity, and availability. Organizations using affected D-Link NAS devices should prioritize mitigation to prevent unauthorized remote access.
CVE-2026-4193 is a medium-severity vulnerability affecting the D-Link DIR-823G router version 1.0.2B05. It involves improper access controls in multiple functions of the goahead component, allowing remote attackers to manipulate critical router settings without authentication or user interaction. The vulnerability impacts various configuration functions such as DDNS, firewall, guest network, LAN/WAN settings, and more. Although the product is no longer supported and no patches are available, the exploit has been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 score is 6.9, reflecting the ease of remote exploitation and the potential for confidentiality, integrity, and availability impacts. Organizations using this router model remain at risk, especially if devices are exposed to untrusted networks.
CVE-2026-4188 is a high-severity stack-based buffer overflow vulnerability in the D-Link DIR-619L router firmware version 2.06B01. The flaw exists in the formSchedule function within the /goform/formSchedule component of the boa web server. An attacker can remotely exploit this vulnerability by manipulating the curTime argument, causing a stack overflow. No user interaction or authentication is required, and the exploit code is publicly available. Although the affected product is no longer supported by D-Link, the vulnerability poses a significant risk to unpatched devices. Successful exploitation could lead to remote code execution with elevated privileges, compromising confidentiality, integrity, and availability. No known exploits in the wild have been reported yet. Organizations using this device should consider device replacement or network segmentation to mitigate risk.
CVE-2026-4184 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-816 router firmware version 1.10CNB05. The flaw exists in the /goform/form2Wl5BasicSetup.cgi endpoint, specifically when processing the pskValue parameter, allowing remote attackers to execute arbitrary code without authentication or user interaction. Although the affected product is no longer supported by the vendor, a public exploit is available, increasing the risk of exploitation. The vulnerability has a CVSS 4.0 score of 9.3, indicating high impact on confidentiality, integrity, and availability. No patches are available, and no known exploits have been observed in the wild yet. Organizations using this router model remain at risk, especially if devices are exposed to the internet.
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-4180 is a medium severity vulnerability affecting the D-Link DIR-816 router running firmware version 1.10CNB05. It involves improper access controls in the redirect.asp component, specifically through manipulation of the token_id argument. The flaw allows remote attackers to bypass access restrictions without authentication or user interaction. Although the exploit code is publicly available, the affected product is no longer supported by the vendor, and no known exploits are currently observed in the wild. The vulnerability could lead to unauthorized access or control over the device, impacting confidentiality, integrity, and availability. Organizations using this outdated router model are at risk and should consider mitigation steps. Due to the product’s market presence, countries with significant consumer or enterprise deployment of D-Link devices are more likely to be affected. Immediate mitigation involves network segmentation, disabling remote management, and replacing unsupported hardware.
A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. The manipulation of the argument wan_connected results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
