CVE-2026-4196

CVE-2026-4196 is a command injection vulnerability affecting multiple D-Link network-attached storage (NAS) devices, including models DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware versions up to 20260205. The issue resides in the cgi_recovery, cgi_backup_now, cgi_set_schedule, and cgi_set_rsync_server functions within the /cgi-bin/remote_backup.cgi script. It has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection).

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring network access and low attack complexity but no user interaction. Successful exploitation allows command injection, enabling limited impacts on confidentiality, integrity, and availability, such as potential execution of arbitrary commands within the context of the affected CGI script.

Advisories and additional details are available via VulDB (ctiid.351108, id.351108, submit.769855) and GitHub repositories documenting the vulnerability (wudipjq/my_vuln D-Link8/vuln_98/98.md and vuln_99/99.md). The exploit has been publicly disclosed and may be in use.

In context, the vulnerability was published on 2026-03-16, with public exploit availability increasing the risk for unpatched D-Link NAS deployments.