CVE-2026-4196
Published: 16 March 2026
Summary
CVE-2026-4196 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dns-1550-04 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific command injection flaw in vulnerable D-Link NAS firmware versions up to 20260205.
Enforces validation and sanitization of inputs to cgi_recovery, cgi_backup_now, cgi_set_schedule, and cgi_set_rsync_server functions to prevent command injection.
Limits privileges of the CGI script processes to minimize impact of injected commands even if exploitation occurs with low-privilege access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (NAS CGI script) for remote command injection, facilitating Unix Shell execution.
NVD Description
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_recovery/cgi_backup_now/cgi_set_schedule/cgi_set_rsync_server of the file /cgi-bin/remote_backup.cgi.…
more
The manipulation leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-4196 is a command injection vulnerability affecting multiple D-Link network-attached storage (NAS) devices, including models DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware versions up to 20260205. The issue resides in the cgi_recovery, cgi_backup_now, cgi_set_schedule, and cgi_set_rsync_server functions within the /cgi-bin/remote_backup.cgi script. It has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring network access and low attack complexity but no user interaction. Successful exploitation allows command injection, enabling limited impacts on confidentiality, integrity, and availability, such as potential execution of arbitrary commands within the context of the affected CGI script.
Advisories and additional details are available via VulDB (ctiid.351108, id.351108, submit.769855) and GitHub repositories documenting the vulnerability (wudipjq/my_vuln D-Link8/vuln_98/98.md and vuln_99/99.md). The exploit has been publicly disclosed and may be in use.
In context, the vulnerability was published on 2026-03-16, with public exploit availability increasing the risk for unpatched D-Link NAS deployments.
Details
- CWE(s)