Read the docs
TI-2026-03661 Aliases CVE-2026-4214GHSA-qg8f-975j-pm28

D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow

Priority HIGH 71CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the file /cgi-bin/app_mgr.cgi. Executing a manipulation can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00841 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
D-LinkDNS-12020260205—No fix listedCNA
D-LinkDNR-202L20260205—No fix listedCNA
D-LinkDNS-315L20260205—No fix listedCNA
D-LinkDNS-32020260205—No fix listedCNA
D-LinkDNS-320L20260205—No fix listedCNA
D-LinkDNS-320LW20260205—No fix listedCNA
D-LinkDNS-32120260205—No fix listedCNA
D-LinkDNR-322L20260205—No fix listedCNA
D-LinkDNS-32320260205—No fix listedCNA
D-LinkDNS-32520260205—No fix listedCNA
D-LinkDNS-32620260205—No fix listedCNA
D-LinkDNS-327L20260205—No fix listedCNA
D-LinkDNR-32620260205—No fix listedCNA
D-LinkDNS-340L20260205—No fix listedCNA
D-LinkDNS-34320260205—No fix listedCNA
D-LinkDNS-34520260205—No fix listedCNA
D-LinkDNS-726-420260205—No fix listedCNA
D-LinkDNS-1100-420260205—No fix listedCNA
D-LinkDNS-1200-0520260205—No fix listedCNA
D-LinkDNS-1550-0420260205—No fix listedCNA
  • DNS-120 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNR-202L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-315L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-320 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-320L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-320LW VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-321 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNR-322L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-323 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-325 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-326 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-327L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNR-326 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-340L VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-343 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-345 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-726-4 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-1100-4 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-1200-05 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA
  • DNS-1550-04 VendorD-Link Affected 20260205 Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*up to 2026-02-05VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:* Versions up to 2026-02-05 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4214
  2. 2026-10-03 Alias added: GHSA-qg8f-975j-pm28

References

Exploit 1

Other 1

  • TI-2024-03070 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-03069 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-00708 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-10693 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-17249 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09657 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE)… KEVCVSS 3.1CRITICAL 9.8
See all 979 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences