CVE-2026-4194
Published: 16 March 2026
Summary
CVE-2026-4194 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to prevent unauthorized remote manipulation via the vulnerable cgi_set_wto function due to improper access controls.
Remediates the specific flaw in affected D-Link NAS firmware versions up to 20260205 that causes improper access controls in the CGI endpoint.
Limits privileges of processes handling CGI requests to minimize the impact of exploitation from improper access controls.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability involves improper access controls in a public-facing CGI script (/cgi-bin/system_mgr.cgi) on D-Link NAS devices, enabling unauthenticated remote exploitation over the network with no user interaction, directly mapping to exploitation of public-facing applications.
NVD Description
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file…
more
/cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-4194 is a vulnerability involving improper access controls in the cgi_set_wto function of the /cgi-bin/system_mgr.cgi file. It affects multiple D-Link network-attached storage (NAS) devices, specifically DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware up to version 20260205. Published on 2026-03-16, it is rated at CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 266 and 284.
The vulnerability enables remote exploitation over the network by unauthenticated attackers with low complexity and no user interaction required. Successful attacks result in limited impacts to confidentiality, integrity, and availability, potentially allowing unauthorized manipulation due to the improper access controls.
Advisories and details are available via VulDB entries (https://vuldb.com/?ctiid.351106, https://vuldb.com/?id.351106, https://vuldb.com/?submit.769853) and the vendor site (https://www.dlink.com/). A public exploit disclosure is hosted at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_96/96.md, indicating active risk of exploitation.
Security practitioners should prioritize inventory checks for affected D-Link NAS models and monitor for firmware updates, given the public availability of the exploit.
Details
- CWE(s)