CVE-2026-7026: D-Link DGS-3420 System Information Settings cross site scripting

Published Apr 26, 2026

Updated

A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processing of the component System Information Settings Page. This manipulation of the argument System Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected Software

3 affected components

D-Link DGS-3420=1.50.018

All of the following

Dlink Dgs-3420-28tc Firmware=1.50.018

Dlink Dgs-3420-28tc

Event History

Apr 26, 2026

CVE Published

via MITRE·07:15 AM

Data Sourced

via MITRE·07:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-7026?

CVE-2026-7026 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2026-7026?

To mitigate CVE-2026-7026, D-Link recommends updating the DGS-3420 to the latest firmware version beyond 1.50.018.

What is the impact of CVE-2026-7026?

The impact of CVE-2026-7026 can lead to unauthorized execution of scripts in the context of a user’s browser, potentially compromising their session and data.

Is CVE-2026-7026 exploitable remotely?

Yes, CVE-2026-7026 is exploitable remotely, allowing attackers to inject malicious scripts via the System Information Settings Page.

What components are affected by CVE-2026-7026?

CVE-2026-7026 specifically affects the System Information Settings component of the D-Link DGS-3420 running firmware version 1.50.018.