CVE-2026-4194
Published: 16 March 2026
Description
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file…
more
/cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to prevent unauthorized remote manipulation via the vulnerable cgi_set_wto function due to improper access controls.
Remediates the specific flaw in affected D-Link NAS firmware versions up to 20260205 that causes improper access controls in the CGI endpoint.
Limits privileges of processes handling CGI requests to minimize the impact of exploitation from improper access controls.
Security SummaryAI
CVE-2026-4194 is a vulnerability involving improper access controls in the cgi_set_wto function of the /cgi-bin/system_mgr.cgi file. It affects multiple D-Link network-attached storage (NAS) devices, specifically DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware up to version 20260205. Published on 2026-03-16, it is rated at CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 266 and 284.
The vulnerability enables remote exploitation over the network by unauthenticated attackers with low complexity and no user interaction required. Successful attacks result in limited impacts to confidentiality, integrity, and availability, potentially allowing unauthorized manipulation due to the improper access controls.
Advisories and details are available via VulDB entries (https://vuldb.com/?ctiid.351106, https://vuldb.com/?id.351106, https://vuldb.com/?submit.769853) and the vendor site (https://www.dlink.com/). A public exploit disclosure is hosted at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_96/96.md, indicating active risk of exploitation.
Security practitioners should prioritize inventory checks for affected D-Link NAS models and monitor for firmware updates, given the public availability of the exploit.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability involves improper access controls in a public-facing CGI script (/cgi-bin/system_mgr.cgi) on D-Link NAS devices, enabling unauthenticated remote exploitation over the network with no user interaction, directly mapping to exploitation of public-facing applications.