Description
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

This vulnerability is a command injection flaw in the FTP_Server_BlockIP_Del functionality of the app_mgr.cgi CGI script on D-Link DNS routers. The flaw allows an unauthenticated, remote attacker to inject arbitrary commands via crafted HTTP requests, potentially resulting in full remote command execution on the device. The weakness is embodied by CWE-74 (Improper Neutralization of Special Elements used in a Command) and CWE-77 (Improper Validation of Constant Parameters).

Affected Systems

Affected devices include a wide range of D-Link routers: D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, versioning up to firmware 20260205.

Risk and Exploitability

The CVSS v3 score is 5.3, indicating moderate potential impact, while the EPSS score is below 1%, suggesting low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, exploiting the app_mgr.cgi over HTTP, and would require network connectivity to the device's administrative interface. Since the flaw can be leveraged without authentication, the risk is elevated for exposed devices.

Generated by OpenCVE AI on March 19, 2026 at 15:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from D-Link for all affected router models.
  • Restrict administrative access to the devices by limiting the IP ranges that can reach the web interface.
  • Disable the FTP server service if it is not required for your network.
  • Monitor the device logs for unexpected commands or login attempts.
  • If an update is not yet available, isolate the devices from critical network segments and apply network segmentation.

Generated by OpenCVE AI on March 19, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 19 Mar 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dnr-202l
Dlink dnr-202l Firmware
Dlink dnr-326
Dlink dnr-326 Firmware
Dlink dns-1100-4
Dlink dns-1100-4 Firmware
Dlink dns-120
Dlink dns-1200-05
Dlink dns-1200-05 Firmware
Dlink dns-120 Firmware
Dlink dns-1550-04
Dlink dns-1550-04 Firmware
Dlink dns-315l
Dlink dns-315l Firmware
Dlink dns-320
Dlink dns-320 Firmware
Dlink dns-320l
Dlink dns-320l Firmware
Dlink dns-320lw
Dlink dns-320lw Firmware
Dlink dns-321
Dlink dns-321 Firmware
Dlink dns-322l
Dlink dns-322l Firmware
Dlink dns-323
Dlink dns-323 Firmware
Dlink dns-325
Dlink dns-325 Firmware
Dlink dns-326
Dlink dns-326 Firmware
Dlink dns-327l
Dlink dns-327l Firmware
Dlink dns-340l
Dlink dns-340l Firmware
Dlink dns-343
Dlink dns-343 Firmware
Dlink dns-345
Dlink dns-345 Firmware
Dlink dns-726-4
Dlink dns-726-4 Firmware
CPEs cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dnr-202l
Dlink dnr-202l Firmware
Dlink dnr-326
Dlink dnr-326 Firmware
Dlink dns-1100-4
Dlink dns-1100-4 Firmware
Dlink dns-120
Dlink dns-1200-05
Dlink dns-1200-05 Firmware
Dlink dns-120 Firmware
Dlink dns-1550-04
Dlink dns-1550-04 Firmware
Dlink dns-315l
Dlink dns-315l Firmware
Dlink dns-320
Dlink dns-320 Firmware
Dlink dns-320l
Dlink dns-320l Firmware
Dlink dns-320lw
Dlink dns-320lw Firmware
Dlink dns-321
Dlink dns-321 Firmware
Dlink dns-322l
Dlink dns-322l Firmware
Dlink dns-323
Dlink dns-323 Firmware
Dlink dns-325
Dlink dns-325 Firmware
Dlink dns-326
Dlink dns-326 Firmware
Dlink dns-327l
Dlink dns-327l Firmware
Dlink dns-340l
Dlink dns-340l Firmware
Dlink dns-343
Dlink dns-343 Firmware
Dlink dns-345
Dlink dns-345 Firmware
Dlink dns-726-4
Dlink dns-726-4 Firmware

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dnr-202l
D-link dnr-322l
D-link dnr-326
D-link dns-1100-4
D-link dns-120
D-link dns-1200-05
D-link dns-1550-04
D-link dns-315l
D-link dns-320
D-link dns-320l
D-link dns-320lw
D-link dns-321
D-link dns-323
D-link dns-325
D-link dns-326
D-link dns-327l
D-link dns-340l
D-link dns-343
D-link dns-345
D-link dns-726-4
Vendors & Products D-link
D-link dnr-202l
D-link dnr-322l
D-link dnr-326
D-link dns-1100-4
D-link dns-120
D-link dns-1200-05
D-link dns-1550-04
D-link dns-315l
D-link dns-320
D-link dns-320l
D-link dns-320lw
D-link dns-321
D-link dns-323
D-link dns-325
D-link dns-326
D-link dns-327l
D-link dns-340l
D-link dns-343
D-link dns-345
D-link dns-726-4

Mon, 16 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_refresh_db/FTP_Server_BlockIP_Add/FTP_Server_BlockIP_Del of the file /cgi-bin/app_mgr.cgi. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Title D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dnr-202l Dnr-322l Dnr-326 Dns-1100-4 Dns-120 Dns-1200-05 Dns-1550-04 Dns-315l Dns-320 Dns-320l Dns-320lw Dns-321 Dns-323 Dns-325 Dns-326 Dns-327l Dns-340l Dns-343 Dns-345 Dns-726-4
Dlink Dnr-202l Dnr-202l Firmware Dnr-326 Dnr-326 Firmware Dns-1100-4 Dns-1100-4 Firmware Dns-120 Dns-1200-05 Dns-1200-05 Firmware Dns-120 Firmware Dns-1550-04 Dns-1550-04 Firmware Dns-315l Dns-315l Firmware Dns-320 Dns-320 Firmware Dns-320l Dns-320l Firmware Dns-320lw Dns-320lw Firmware Dns-321 Dns-321 Firmware Dns-322l Dns-322l Firmware Dns-323 Dns-323 Firmware Dns-325 Dns-325 Firmware Dns-326 Dns-326 Firmware Dns-327l Dns-327l Firmware Dns-340l Dns-340l Firmware Dns-343 Dns-343 Firmware Dns-345 Dns-345 Firmware Dns-726-4 Dns-726-4 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T14:40:36.751Z

Reserved: 2026-03-15T11:36:55.279Z

Link: CVE-2026-4205

cve-icon Vulnrichment

Updated: 2026-03-16T14:37:01.885Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-16T14:20:05.900

Modified: 2026-03-19T14:24:13.550

Link: CVE-2026-4205

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:00:43Z

Weaknesses