Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

D-Link DNS-120D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control

Risk 19
Severity
5.3
EPSS
0.06%
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgigetipv6 of the file /cgi-bin/networkmgr.cgi. Such manipulation leads to improper access controls. The exploit is publicly available and might be used.

First published (updated )
CVE-2026-5215

D-Link DNS-120D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection

Risk 61
Severity
5.3
EPSS
0.10%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgitmsetshare of the file /cgi-bin/timemachine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

First published (updated )
CVE-2026-4210

D-Link DNS-120D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injection

Risk 61
Severity
5.3
EPSS
0.11%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgicreateimportusers/cgiuserbatchcreate/cgiusersetquota/cgiuserdel/cgiusermodify/cgigroupsetquota/cgigroupmodify/cgigroupadd/cgiuseradd/cgigetmodifygroupinfo/cgichgadminpw of the file /cgi-bin/accountmgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

First published (updated )
CVE-2026-4209

D-Link DNS-120D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injection

Risk 61
Severity
5.3
EPSS
0.11%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgidevice/cgismstest/cgifirmwareupload/cgintptime of the file /cgi-bin/systemmgr.cgi. Executing a manipulation can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

First published (updated )
CVE-2026-4207

D-Link DNS-120D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection

Risk 61
Severity
5.3
EPSS
0.17%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function FMTrebuilddiskmgr/FMTcreatediskmgr/ScanDiskrune2fsck of the file /cgi-bin/dskmgr.cgi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

First published (updated )
CVE-2026-4206

D-Link DNS-120D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection

Risk 61
Severity
5.3
EPSS
0.17%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgirefreshdb/FTPServerBlockIPAdd/FTPServerBlockIPDel of the file /cgi-bin/appmgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

First published (updated )
CVE-2026-4205

D-Link DNS-120D-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injection

Risk 61
Severity
5.3
EPSS
0.10%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgimyfavoriteadd/cgimyfavoriteset/cgimyfavoritedel/cgimyfavoritesetsortinfo/cgimyfavoriteremoveapkg/cgimyfavoritecompareapkg/cgimycloudautodownlaod of the file /cgi-bin/guimgr.cgi. This manipulation of the argument fuser causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

First published (updated )
CVE-2026-4204

D-Link DNS-120D-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injection

Risk 61
Severity
5.3
EPSS
0.08%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgiportforwardingadd/cgiportforwardingdel/cgiportforwardingmodify/cgiportforwardingaddscan/cgidhcpdlease/cgiddns/cgiip/cgidhcpd of the file /cgi-bin/networkmgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

First published (updated )
CVE-2026-4203

D-Link DNS-120D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection

Risk 61
Severity
5.3
EPSS
0.11%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function RSSGetUpdateStatus/RSSUpdate/RSSChannelAutoDownlaod/RSSAdd/RSSChannelItemDownlaod/RSSHistoryItemList/RSSItemList of the file /cgi-bin/downloadmgr.cgi. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

First published (updated )
CVE-2026-4197

D-Link DNS-120D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection

Risk 61
Severity
5.3
EPSS
0.11%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgirecovery/cgibackupnow/cgisetschedule/cgisetrsyncserver of the file /cgi-bin/remotebackup.cgi. The manipulation leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

First published (updated )
CVE-2026-4196

D-Link DNS-120D-Link DNS-1550-04 wizard_mgr.cgi command injection

Risk 61
Severity
5.3
EPSS
0.10%
Command Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown function of the file /cgi-bin/wizardmgr.cgi. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.

First published (updated )
CVE-2026-4195

D-Link DNS-120D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control

Risk 61
Severity
6.9
EPSS
0.05%
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgisetwto of the file /cgi-bin/systemmgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

First published (updated )
CVE-2026-4194

Dlink Dns-320 FirmwareD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure

Risk 33
Severity
6.9
Infoleak
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

First published (updated )
CVE-2024-10916

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203