CVE-2026-4195
Published: 16 March 2026
Summary
CVE-2026-4195 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely installation of firmware patches from D-Link to remediate the specific command injection flaw in /cgi-bin/wizard_mgr.cgi.
Mandates validation of user inputs to the vulnerable CGI function to directly block command injection payloads.
Implements boundary protection such as web application firewalls to inspect and block remote command injection attempts on the NAS web interface.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing CGI script enables exploitation of public-facing application (T1190) and Unix shell command execution (T1059.004) on Linux-based NAS devices.
NVD Description
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown function of the file /cgi-bin/wizard_mgr.cgi.…
more
Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-4195 is a command injection vulnerability in an unknown function of the /cgi-bin/wizard_mgr.cgi file, affecting multiple D-Link NAS devices including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware up to version 20260205. Published on 2026-03-16, it is associated with CWEs-74 and CWE-77.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating remote network access with low attack complexity and requiring low privileges. An authenticated attacker can execute manipulations leading to command injection, achieving limited impacts on confidentiality, integrity, and availability.
Advisories referenced in VulDB entries (e.g., https://vuldb.com/?ctiid.351107, https://vuldb.com/?id.351107) and a GitHub proof-of-concept (https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_97/97.md) detail the issue; consult D-Link's site (https://www.dlink.com/) for potential patches or updates.
The exploit has been publicly disclosed and may be actively used in attacks.
Details
- CWE(s)