PT-2026-25589 · D Link · Dnr-202L+18

Pjqwudi · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4209

NVD

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi create import users/cgi user batch create/cgi user set quota/cgi user del/cgi user modify/cgi group set quota/cgi group modify/cgi group add/cgi user add/cgi get modify group info/cgi chg admin pw of the file /cgi-bin/account mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-4209

Affected Products

Dnr-202L

Dnr-322L

Dnr-326

Dns-1100-4

Dns-120

Dns-1200-05

Dns-1550-04

Dns-315L

Dns-320

Dns-320L

Dns-321

Dns-323

Dns-325

Dns-326

Dns-327L

Dns-340L

Dns-343

Dns-345

Dns-726-4

References · 17

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_149/149.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-4209 · Security Note
• ❌ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_148/148.md · Note, Deleted
• https://vuldb.com/?submit.770438 · Note
• https://vuldb.com/?ctiid.351120 · Note
• https://vuldb.com/?submit.770429 · Note
• https://twitter.com/cyberbivash/status/2033421282516045899 · Twitter Post
• https://vuldb.com/?submit.770431 · Note
• https://vuldb.com/?submit.770434 · Note
• https://vuldb.com/?submit.770437 · Note
• https://dlink.com · Note
• https://vuldb.com/?id.351120 · Note
• https://vuldb.com/?submit.770435 · Note
• https://vuldb.com/?submit.770432 · Note
• https://vuldb.com/?submit.770433 · Note