Cyber Posture

CVE-2026-5211

HighPublic PoC

Published: 31 March 2026

Published
31 March 2026
Modified
02 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0004 11.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5211 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validating the f_dir argument in the UPnP_AV_Server_Path_Del function to prevent the stack-based buffer overflow from malicious input.

prevent

SI-16 implements memory protections like stack canaries and non-executable stacks to block arbitrary code execution from the stack-based buffer overflow in app_mgr.cgi.

prevent

SI-2 mandates timely flaw remediation through firmware updates for affected D-Link NAS devices to eliminate the buffer overflow vulnerability up to version 20260205.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in public-facing /cgi-bin/app_mgr.cgi CGI script on D-Link NAS devices directly enables remote exploitation of public-facing applications (T1190) for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function UPnP_AV_Server_Path_Del of the file…

more

/cgi-bin/app_mgr.cgi. Executing a manipulation of the argument f_dir can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Deeper analysisAI

CVE-2026-5211 is a stack-based buffer overflow vulnerability in the UPnP_AV_Server_Path_Del function within the /cgi-bin/app_mgr.cgi file. It affects multiple D-Link Network Attached Storage (NAS) devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, running firmware versions up to 20260205. The issue stems from improper handling of the f_dir argument and is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring no user interaction. By manipulating the f_dir argument, an attacker can trigger the buffer overflow, potentially leading to high-impact consequences including arbitrary code execution, data compromise, system modification, and denial of service.

Advisories and details are documented on VulDB (including submission at https://vuldb.com/submit/780434 and vulnerability pages at https://vuldb.com/vuln/354347 and https://vuldb.com/vuln/354347/cti), with an exploit published on GitHub at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_165/165.md; D-Link's website at https://www.dlink.com/ may provide further patch information. Security practitioners should check these resources for mitigation guidance and firmware updates.

Details

CWE(s)

Affected Products

dlink
dnr-202l firmware
≤ 2026-02-05
dlink
dnr-326 firmware
≤ 2026-02-05
dlink
dns-1100-4 firmware
≤ 2026-02-05
dlink
dns-120 firmware
≤ 2026-02-05
dlink
dns-1200-05 firmware
≤ 2026-02-05
dlink
dns-1550-04 firmware
≤ 2026-02-05
dlink
dns-315l firmware
≤ 2026-02-05
dlink
dns-320 firmware
≤ 2026-02-05
dlink
dns-320l firmware
≤ 2026-02-05
dlink
dns-320lw firmware
≤ 2026-02-05
+10 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-5213Same product: Dlink Dnr-202L
CVE-2026-4211Same product: Dlink Dnr-202L
CVE-2026-5212Same product: Dlink Dnr-202L
CVE-2026-5214Same product: Dlink Dnr-202L
CVE-2026-4214Same product: Dlink Dnr-202L
CVE-2026-4213Same product: Dlink Dnr-202L
CVE-2026-4212Same product: Dlink Dnr-202L
CVE-2026-4194Same product: Dlink Dnr-202L
CVE-2026-4197Same product: Dlink Dnr-202L
CVE-2026-4196Same product: Dlink Dnr-202L

References