CVE-2026-4203
Published: 16 March 2026
Description
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The…
more
manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly and comprehensively prevents command injection by validating and sanitizing user inputs to the vulnerable CGI functions like cgi_portforwarding_add.
SI-2 ensures timely identification, reporting, and patching of the command injection flaw in affected D-Link NAS firmware versions.
RA-5 enables regular vulnerability scanning to detect the presence of CVE-2026-4203 in deployed D-Link NAS devices and initiate remediation.
Security SummaryAI
CVE-2026-4203 is a command injection vulnerability (CWE-74, CWE-77) affecting multiple D-Link NAS devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, up to firmware version 20260205. The flaw exists in the functions cgi_portforwarding_add, cgi_portforwarding_del, cgi_portforwarding_modify, cgi_portforwarding_add_scan, cgi_dhcpd_lease, cgi_ddns, cgi_ip, and cgi_dhcpd within the /cgi-bin/network_mgr.cgi component.
An attacker can exploit this vulnerability remotely over the network with low privileges (PR:L), low attack complexity (AC:L), and no user interaction required. Exploitation enables limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), as reflected in its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Advisories and technical details are documented in VulDB entries (ctiid.351115, id.351115, submit.770401) and GitHub repositories at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_122/122.md and https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_123/123.md, which may include mitigation guidance.
The exploit is publicly available, facilitating potential widespread use against vulnerable devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing CGI endpoints on network devices enables exploitation of public-facing applications (T1190) and execution via Unix shell (T1059.004).