Cyber Posture

CVE-2026-4214

HighPublic PoC

Published: 16 March 2026

Published
16 March 2026
Modified
19 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 18.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4214 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the stack-based buffer overflow by identifying, reporting, and applying firmware patches for the vulnerable UPnP_AV_Server_Path_Setting function in affected D-Link NAS devices.

prevent

Requires validation of inputs to the /cgi-bin/app_mgr.cgi UPnP path setting function to prevent stack buffer overflows from malformed data.

prevent

Implements memory safeguards such as stack canaries, DEP, and ASLR to block arbitrary code execution from stack-based buffer overflow exploits.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Remote stack buffer overflow in public-facing web CGI (/cgi-bin/app_mgr.cgi) on NAS devices allows authenticated low-priv remote attackers to achieve arbitrary code execution, directly mapping to exploitation of public-facing apps (T1190) and exploitation for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the file…

more

/cgi-bin/app_mgr.cgi. Executing a manipulation can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

Deeper analysisAI

CVE-2026-4214 is a stack-based buffer overflow vulnerability affecting the UPnP_AV_Server_Path_Setting function in the /cgi-bin/app_mgr.cgi file across multiple D-Link NAS devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 running firmware up to version 20260205. The flaw, associated with CWEs-119, CWE-121, and CWE-787, was published on 2026-03-16.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network with low complexity by an attacker possessing low privileges. Successful exploitation triggers a stack-based buffer overflow, potentially enabling high-impact compromise of confidentiality, integrity, and availability, such as arbitrary code execution.

Advisories and further details, including potential mitigations or patches, are documented on VulDB (https://vuldb.com/?ctiid.351125, https://vuldb.com/?id.351125, https://vuldb.com/?submit.770445) and the D-Link website (https://www.dlink.com/). A public exploit is available on GitHub (https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_164/164.md), increasing the risk of real-world attacks on unpatched devices.

Details

CWE(s)

Affected Products

dlink
dnr-202l firmware
≤ 2026-02-05
dlink
dnr-326 firmware
≤ 2026-02-05
dlink
dns-1100-4 firmware
≤ 2026-02-05
dlink
dns-120 firmware
≤ 2026-02-05
dlink
dns-1200-05 firmware
≤ 2026-02-05
dlink
dns-1550-04 firmware
≤ 2026-02-05
dlink
dns-315l firmware
≤ 2026-02-05
dlink
dns-320 firmware
≤ 2026-02-05
dlink
dns-320l firmware
≤ 2026-02-05
dlink
dns-320lw firmware
≤ 2026-02-05
+10 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-4213Same product: Dlink Dnr-202L
CVE-2026-4212Same product: Dlink Dnr-202L
CVE-2026-5213Same product: Dlink Dnr-202L
CVE-2026-4211Same product: Dlink Dnr-202L
CVE-2026-5212Same product: Dlink Dnr-202L
CVE-2026-5214Same product: Dlink Dnr-202L
CVE-2026-5211Same product: Dlink Dnr-202L
CVE-2026-4194Same product: Dlink Dnr-202L
CVE-2026-4197Same product: Dlink Dnr-202L
CVE-2026-4196Same product: Dlink Dnr-202L

References