CVE-2026-5211
Published: 31 March 2026
Summary
CVE-2026-5211 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dnr-202L Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5211 is a stack-based buffer overflow vulnerability in the UPnP_AV_Server_Path_Del function within the /cgi-bin/app_mgr.cgi file. It affects multiple D-Link Network Attached Storage (NAS) devices, including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, running firmware versions up to 20260205. The issue stems from improper handling of the f_dir argument and is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring no user interaction. By manipulating the f_dir argument, an attacker can trigger the buffer overflow, potentially leading to high-impact consequences including arbitrary code execution, data compromise, system modification, and denial of service.
Advisories and details are documented on VulDB (including submission at https://vuldb.com/submit/780434 and vulnerability pages at https://vuldb.com/vuln/354347 and https://vuldb.com/vuln/354347/cti), with an exploit published on GitHub at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_165/165.md; D-Link's website at https://www.dlink.com/ may provide further patch information. Security practitioners should check these resources for mitigation guidance and firmware updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17613
Vulnerability details
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function UPnP_AV_Server_Path_Del of the file…
more
/cgi-bin/app_mgr.cgi. Executing a manipulation of the argument f_dir can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing /cgi-bin/app_mgr.cgi CGI script on D-Link NAS devices directly enables remote exploitation of public-facing applications (T1190) for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validating the f_dir argument in the UPnP_AV_Server_Path_Del function to prevent the stack-based buffer overflow from malicious input.
SI-16 implements memory protections like stack canaries and non-executable stacks to block arbitrary code execution from the stack-based buffer overflow in app_mgr.cgi.
SI-2 mandates timely flaw remediation through firmware updates for affected D-Link NAS devices to eliminate the buffer overflow vulnerability up to version 20260205.