exploitDog

CVE-2026-4209

Опубликовано: 16 мар. 2026

Источник: nvd

CVSS3: 6.3

CVSS3: 9.8

CVSS2: 6.5

EPSS Низкий

Описание

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Ссылки

https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_148/148.md
Exploit
Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_149/149.md
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.351120
Permissions Required
VDB Entry
https://vuldb.com/?id.351120
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770429
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770430
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770431
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770432
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770433
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770434
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770435
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770436
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770437
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.770438
Third Party Advisory
VDB Entry
https://www.dlink.com/
Product

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*

Конфигурация 12

Одновременно

cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:*

Конфигурация 13

Одновременно

cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*

Конфигурация 14

Одновременно

cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*

Конфигурация 15

Одновременно

cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*

Конфигурация 16

Одновременно

cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*

Конфигурация 17

Одновременно

cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*

Конфигурация 18

Одновременно

cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*

Конфигурация 19

Одновременно

cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*

Конфигурация 20

Одновременно

cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*

Версия до 2026-02-05 (включая)

cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00115

Низкий

6.3 Medium

CVSS3

9.8 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-74

CWE-77

Связанные уязвимости

GHSA-frpm-2wwm-5rh6

CVSS3: 6.3

github

25 дней назад

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function cgi_create_import_users/cgi_user_batch_create/cgi_user_set_quota/cgi_user_del/cgi_user_modify/cgi_group_set_quota/cgi_group_modify/cgi_group_add/cgi_user_add/cgi_get_modify_group_info/cgi_chg_admin_pw of the file /cgi-bin/account_mgr.cgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

EPSS

Процентиль: 30%

0.00115

Низкий

6.3 Medium

CVSS3

9.8 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-74

CWE-77