CVE-2026-4210
Published: 16 March 2026
Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share…
more
of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the manipulated 'Name' argument in the cgi_tm_set_share function of time_machine.cgi.
Requires timely identification, reporting, and correction of the specific command injection flaw in affected D-Link NAS firmware versions up to 20260205.
Enables scanning for this publicly disclosed CVE to identify vulnerable D-Link NAS devices and prioritize remediation before exploitation.
Security SummaryAI
CVE-2026-4210 is a command injection vulnerability (CWE-74, CWE-77) discovered in multiple D-Link NAS devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, with firmware versions up to 20260205. The issue affects the cgi_tm_set_share function in the /cgi-bin/time_machine.cgi file, where manipulation of the "Name" argument triggers the injection.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and can be exploited remotely by an attacker with low privileges. Exploitation enables limited impacts on confidentiality, integrity, and availability, such as arbitrary command execution on the affected device.
Advisories and further details, including the publicly released exploit, are documented on VulDB (ctiid.351121, id.351121, submit.770440) and a GitHub repository at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_159/159.md, with a general reference to the D-Link website at https://www.dlink.com/. Specific mitigation or patch guidance is not detailed in the CVE description.
The public availability of the exploit heightens the risk of real-world attacks against unpatched devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web CGI endpoint (cgi_tm_set_share) on network-exposed NAS devices enables exploitation of public-facing application (T1190) for arbitrary Unix shell command execution (T1059.004).