CVE-2026-4195
Published: 16 March 2026
Description
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown function of the file /cgi-bin/wizard_mgr.cgi.…
more
Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely installation of firmware patches from D-Link to remediate the specific command injection flaw in /cgi-bin/wizard_mgr.cgi.
Mandates validation of user inputs to the vulnerable CGI function to directly block command injection payloads.
Implements boundary protection such as web application firewalls to inspect and block remote command injection attempts on the NAS web interface.
Security SummaryAI
CVE-2026-4195 is a command injection vulnerability in an unknown function of the /cgi-bin/wizard_mgr.cgi file, affecting multiple D-Link NAS devices including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware up to version 20260205. Published on 2026-03-16, it is associated with CWEs-74 and CWE-77.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating remote network access with low attack complexity and requiring low privileges. An authenticated attacker can execute manipulations leading to command injection, achieving limited impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (e.g., https://vuldb.com/?ctiid.351107, https://vuldb.com/?id.351107) and a GitHub proof-of-concept (https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_97/97.md) detail the issue; consult D-Link's site (https://www.dlink.com/) for potential patches or updates.
The exploit has been publicly disclosed and may be actively used in attacks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing CGI script enables exploitation of public-facing application (T1190) and Unix shell command execution (T1059.004) on Linux-based NAS devices.