PT-2026-29599 · D Link · Dnr-202L+18

Ziyue Xie · CVE-2026-5311 · Published 2026-03-03 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205

Description Improper access controls exist in the Webdav Access List() function within the /cgi-bin/file center.cgi endpoint. A remote attacker can manipulate the cmd variable to bypass security restrictions and gain unauthorized access to protected information.

Recommendations Update D-Link DNS-120 to version 20260205 or later. Update D-Link DNR-202L to version 20260205 or later. Update D-Link DNS-315L to version 20260205 or later. Update D-Link DNS-320 to version 20260205 or later. Update D-Link DNS-320L to version 20260205 or later. Update D-Link DNS-320LW to version 20260205 or later. Update D-Link DNS-321 to version 20260205 or later. Update D-Link DNR-322L to version 20260205 or later. Update D-Link DNS-323 to version 20260205 or later. Update D-Link DNS-325 to version 20260205 or later. Update D-Link DNS-326 to version 20260205 or later. Update D-Link DNS-327L to version 20260205 or later. Update D-Link DNR-326 to version 20260205 or later. Update D-Link DNS-340L to version 20260205 or later. Update D-Link DNS-343 to version 20260205 or later. Update D-Link DNS-345 to version 20260205 or later. Update D-Link DNS-726-4 to version 20260205 or later. Update D-Link DNS-1100-4 to version 20260205 or later. Update D-Link DNS-1200-05 to version 20260205 or later. Update D-Link DNS-1550-04 to version 20260205 or later. As a temporary workaround, restrict access to the /cgi-bin/file center.cgi endpoint.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

BDU:2026-09490

CVE-2026-5311

Affected Products

Dnr-202L

Dnr-322L

Dnr-326

Dns-1100-4

Dns-120

Dns-1200-05

Dns-1550-04

Dns-315L

Dns-320

Dns-320L

Dns-321

Dns-323

Dns-325

Dns-326

Dns-327L

Dns-340L

Dns-343

Dns-345

Dns-726-4

References · 7

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-5311 · Security Note
• https://bdu.fstec.ru/vul/2026-09490 · Security Note
• https://vuldb.com/vuln/354640/cti · Note
• https://vuldb.com/submit/780441 · Note
• https://vuldb.com/vuln/354640 · Note
• https://dlink.com · Note