PT-2026-29614 · D Link · Dnr-202L+18

Ziyue Xie · CVE-2026-5312 · Published 2026-03-03 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205

Description Improper access controls in the /cgi-bin/dsk mgr.cgi endpoint allow a remote attacker to perform unauthorized manipulations. This issue affects several functions within the specified file, including FMT restart(), Status HDInfo(), SMART List(), ScanDisk info(), ScanDisk(), volume status(), Get Volume Mapping(), FMT check disk remount state(), FMT rebuildinfo(), FMT result list(), FMT result list phy(), FMT get dminfo(), FMT manually rebuild info(), and Get current raidtype(). Successful exploitation can impact the availability of protected information.

Recommendations Update D-Link DNS-120 to version 20260205 or later. Update D-Link DNR-202L to version 20260205 or later. Update D-Link DNS-315L to version 20260205 or later. Update D-Link DNS-320 to version 20260205 or later. Update D-Link DNS-320L to version 20260205 or later. Update D-Link DNS-320LW to version 20260205 or later. Update D-Link DNS-321 to version 20260205 or later. Update D-Link DNR-322L to version 20260205 or later. Update D-Link DNS-323 to version 20260205 or later. Update D-Link DNS-325 to version 20260205 or later. Update D-Link DNS-326 to version 20260205 or later. Update D-Link DNS-327L to version 20260205 or later. Update D-Link DNR-326 to version 20260205 or later. Update D-Link DNS-340L to version 20260205 or later. Update D-Link DNS-343 to version 20260205 or later. Update D-Link DNS-345 to version 20260205 or later. Update D-Link DNS-726-4 to version 20260205 or later. Update D-Link DNS-1100-4 to version 20260205 or later. Update D-Link DNS-1200-05 to version 20260205 or later. Update D-Link DNS-1550-04 to version 20260205 or later. As a temporary mitigation, restrict access to the /cgi-bin/dsk mgr.cgi endpoint.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

BDU:2026-09491

CVE-2026-5312

Affected Products

Dnr-202L

Dnr-322L

Dnr-326

Dns-1100-4

Dns-120

Dns-1200-05

Dns-1550-04

Dns-315L

Dns-320

Dns-320L

Dns-321

Dns-323

Dns-325

Dns-326

Dns-327L

Dns-340L

Dns-343

Dns-345

Dns-726-4

References · 9

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_173/173.md · Exploit, Deleted
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_172/172.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-5312 · Security Note
• https://bdu.fstec.ru/vul/2026-09491 · Security Note
• https://vuldb.com/submit/780443 · Note
• https://vuldb.com/vuln/354641 · Note
• https://vuldb.com/vuln/354641/cti · Note
• https://dlink.com · Note
• https://vuldb.com/submit/780442 · Note