CVE-2026-4210
Published: 16 March 2026
Summary
CVE-2026-4210 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the manipulated 'Name' argument in the cgi_tm_set_share function of time_machine.cgi.
Requires timely identification, reporting, and correction of the specific command injection flaw in affected D-Link NAS firmware versions up to 20260205.
Enables scanning for this publicly disclosed CVE to identify vulnerable D-Link NAS devices and prioritize remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web CGI endpoint (cgi_tm_set_share) on network-exposed NAS devices enables exploitation of public-facing application (T1190) for arbitrary Unix shell command execution (T1059.004).
NVD Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share…
more
of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-4210 is a command injection vulnerability (CWE-74, CWE-77) discovered in multiple D-Link NAS devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, with firmware versions up to 20260205. The issue affects the cgi_tm_set_share function in the /cgi-bin/time_machine.cgi file, where manipulation of the "Name" argument triggers the injection.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and can be exploited remotely by an attacker with low privileges. Exploitation enables limited impacts on confidentiality, integrity, and availability, such as arbitrary command execution on the affected device.
Advisories and further details, including the publicly released exploit, are documented on VulDB (ctiid.351121, id.351121, submit.770440) and a GitHub repository at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_159/159.md, with a general reference to the D-Link website at https://www.dlink.com/. Specific mitigation or patch guidance is not detailed in the CVE description.
The public availability of the exploit heightens the risk of real-world attacks against unpatched devices.
Details
- CWE(s)