CVE-2026-4213
Published: 16 March 2026
Summary
CVE-2026-4213 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely patching and remediation of the stack-based buffer overflow vulnerability in affected D-Link NAS firmware.
Enforces validation of untrusted inputs to CGI functions like cgi_myfavorite_del_user and cgi_myfavorite_verify to prevent buffer overflow exploitation.
Implements memory protection mechanisms such as stack canaries, ASLR, and DEP to block exploitation of the stack-based buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing NAS web CGI (/cgi-bin/gui_mgr.cgi) with PR:L allows remote exploitation for RCE (T1190: Exploit Public-Facing Application) and subsequent privilege escalation to high impact (T1068: Exploitation for Privilege Escalation).
NVD Description
A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi.…
more
Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-4213 is a stack-based buffer overflow vulnerability (associated with CWE-119, CWE-121, and CWE-787) in the functions cgi_myfavorite_del_user and cgi_myfavorite_verify within the file /cgi-bin/gui_mgr.cgi. It affects multiple D-Link NAS devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, running firmware versions up to 20260205. The issue was published on 2026-03-16 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Manipulation of the affected CGI endpoints triggers the buffer overflow, potentially allowing the attacker to achieve high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or denial of service.
Advisories and additional details are available via VulDB entries (ctiid.351124, id.351124, submit.770443) and GitHub repositories documenting the vulnerabilities. No specific patch or mitigation guidance is detailed in the initial disclosure.
The exploit is public and may be used, as noted in the vulnerability description, heightening risks for unpatched D-Link NAS devices exposed to the internet.
Details
- CWE(s)