CVE-2026-4212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4212", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-15T12:02:46.389Z", "datePublished": "2026-03-16T03:32:14.004Z", "dateUpdated": "2026-03-16T15:30:26.181Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T03:32:14.004Z"}, "title": "D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "D-Link", "product": "DNS-120", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNR-202L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-315L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-320", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-320L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-320LW", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-321", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNR-322L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-323", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-325", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-326", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-327L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNR-326", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-340L", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-343", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-345", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-726-4", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-1100-4", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-1200-05", "versions": [{"version": "20260205", "status": "affected"}]}, {"vendor": "D-Link", "product": "DNS-1550-04", "versions": [{"version": "20260205", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function Downloads_Schedule_Info of the file /cgi-bin/download_mgr.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-15T13:07:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "pjqwudi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.351123", "name": "VDB-351123 | D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351123", "name": "VDB-351123 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770442", "name": "Submit #770442 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05/1550-04 up to 20260205 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_161/161.md", "tags": ["exploit"]}, {"url": "https://www.dlink.com/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T15:30:18.101617Z", "id": "CVE-2026-4212", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:30:26.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4212", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T15:30:18.101617Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:30:22.438Z"}}], "cna": {"title": "D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "pjqwudi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "D-Link", "product": "DNS-120", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNR-202L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-315L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-320", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-320L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-320LW", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-321", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNR-322L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-323", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-325", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-326", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-327L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNR-326", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-340L", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-343", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-345", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-726-4", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-1100-4", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-1200-05", "versions": [{"status": "affected", "version": "20260205"}]}, {"vendor": "D-Link", "product": "DNS-1550-04", "versions": [{"status": "affected", "version": "20260205"}]}], "timeline": [{"lang": "en", "time": "2026-03-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-15T13:07:55.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351123", "name": "VDB-351123 | D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351123", "name": "VDB-351123 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770442", "name": "Submit #770442 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05/1550-04 up to 20260205 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_161/161.md", "tags": ["exploit"]}, {"url": "https://www.dlink.com/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function Downloads_Schedule_Info of the file /cgi-bin/download_mgr.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T03:32:14.004Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4212", "state": "PUBLISHED", "dateUpdated": "2026-03-16T15:30:26.181Z", "dateReserved": "2026-03-15T12:02:46.389Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T03:32:14.004Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "DNS-120", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNR-202L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-315L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-320", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-320L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-320LW", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-321", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNR-322L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-323", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-325", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-326", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-327L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNR-326", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-340L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-343", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-345", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-726-4", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-1100-4", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-1200-05", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}, {"product": "DNS-1550-04", "vendor": "D-Link", "versions": [{"status": "affected", "version": "20260205"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E20A03F5-6985-4917-8E5B-48963FB62AF2", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*", "matchCriteriaId": "07A92F2C-16FD-4A53-8066-83FEC2818DF5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "926D7527-749C-4EDC-BF6A-76A199D5C1B5", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*", "matchCriteriaId": "33CB308B-CF82-4E40-B2DC-23EBD48CD130", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "84EB9230-7817-44C4-B248-BA9C1CEC2A41", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5D08ED7-3E7F-4D30-890E-6535F6C34682", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F37C8F08-CEE9-4D2B-A273-B0AB57B874B5", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*", "matchCriteriaId": "6E161E54-2FE9-4359-9B2D-8700D00DE8E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E85AC494-B63A-450E-BCDA-EC9C53A90A5A", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*", "matchCriteriaId": "D042C75D-6731-46B2-B11E-A009B9029B3F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAE008F5-7F73-4572-B575-FF0AD3FA2A78", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*", "matchCriteriaId": "E691E775-382C-4BA9-AA44-FBC3148D3E54", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D1F595A-2595-4D20-A7F7-D0D954F72554", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*", "matchCriteriaId": "03C5CED7-55A7-4026-95CD-A2ADB5853823", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E07DE4E-1B8A-4B92-BBFB-7EAED86F04FB", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*", "matchCriteriaId": "A0F5355E-F68D-49FE-9793-1FD9BD9AF3E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF83B802-8DD9-48D3-9DAC-C24774163FA4", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C677E53-6885-4EC4-A7CC-E24E8F445F59", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F8FFDF4-6DDA-4FD8-A0E8-19C31187DBAD", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*", "matchCriteriaId": "45467ABC-BAA9-4EB0-9F97-92E31854CA8B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "37D1BADB-2F38-40B0-A709-098C89249763", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A278BC9-6197-43D9-93C2-3DF760856FB7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "984FFAAE-E211-4CDA-9C5A-663DCA8867E7", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:*", "matchCriteriaId": "82DD4836-A87C-42CC-A41B-B97B1BCA4886", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "90990A02-23AC-4A71-9095-C703C2F718CE", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*", "matchCriteriaId": "94ED678A-AB4C-4637-B0D8-C232A0BB5D5F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3DCCD0CB-A8C6-455F-9888-A86BB933E68E", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*", "matchCriteriaId": "8042169D-D9FA-4BD6-90D1-E0DE269E42B9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B8293E4-993E-43E8-8FD0-F76DF42F1EA1", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*", "matchCriteriaId": "D26F4F77-A6E3-4D7D-A781-BEB5FF7BC44F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4823E56-B773-4855-AAA1-204ECCB443F3", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB305B29-7F89-4A52-9ECF-3DB0BDD2350D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "70B8EE5F-52E8-48CC-A08B-0F18976078B2", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*", "matchCriteriaId": "0646B20C-5642-4CEA-A96C-7E82AD94A281", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE10B057-CB8F-4DAA-8F4F-790EC3D828A9", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*", "matchCriteriaId": "F968791D-D3BD-442C-818E-4E878B12776D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F90663BB-9C43-472F-9E79-91566C0DA82E", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7E56821-7EA0-4CA1-BA17-7FD4ED9F794C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CBA8638-A030-43BC-A86F-09BA6F9189B8", "versionEndIncluding": "2026-02-05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*", "matchCriteriaId": "75E5010F-21BA-4B6B-B00C-2688268FD67B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the function Downloads_Schedule_Info of the file /cgi-bin/download_mgr.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta 20260205. Esto afecta la funci\u00f3n Downloads_Schedule_Info del archivo /cgi-bin/download_mgr.cgi. Dicha manipulaci\u00f3n conduce a un desbordamiento de b\u00fafer basado en pila. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado."}], "id": "CVE-2026-4212", "lastModified": "2026-06-17T10:56:12.480", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4212", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T15:30:18.101617Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:20:07.663", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_161/161.md"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.351123"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.351123"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.770442"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://www.dlink.com/"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNR-202L", "source": "cna", "vendor": "D-Link"}, "product": "dnr-202l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNR-322L", "source": "cna", "vendor": "D-Link"}, "product": "dnr-322l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNR-326", "source": "cna", "vendor": "D-Link"}, "product": "dnr-326", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-1100-4", "source": "cna", "vendor": "D-Link"}, "product": "dns-1100-4", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-120", "source": "cna", "vendor": "D-Link"}, "product": "dns-120", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-1200-05", "source": "cna", "vendor": "D-Link"}, "product": "dns-1200-05", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-1550-04", "source": "cna", "vendor": "D-Link"}, "product": "dns-1550-04", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-315L", "source": "cna", "vendor": "D-Link"}, "product": "dns-315l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-320", "source": "cna", "vendor": "D-Link"}, "product": "dns-320", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-320L", "source": "cna", "vendor": "D-Link"}, "product": "dns-320l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-320LW", "source": "cna", "vendor": "D-Link"}, "product": "dns-320lw", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-321", "source": "cna", "vendor": "D-Link"}, "product": "dns-321", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-323", "source": "cna", "vendor": "D-Link"}, "product": "dns-323", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-325", "source": "cna", "vendor": "D-Link"}, "product": "dns-325", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-326", "source": "cna", "vendor": "D-Link"}, "product": "dns-326", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-327L", "source": "cna", "vendor": "D-Link"}, "product": "dns-327l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-340L", "source": "cna", "vendor": "D-Link"}, "product": "dns-340l", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-343", "source": "cna", "vendor": "D-Link"}, "product": "dns-343", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-345", "source": "cna", "vendor": "D-Link"}, "product": "dns-345", "vendor": "d-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260205"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNS-726-4", "source": "cna", "vendor": "D-Link"}, "product": "dns-726-4", "vendor": "d-link"}], "analysis": {"en": {"generated_at": "2026-03-19T16:02:33.849502+00:00", "value": {"mitigation_remediation": ["Update the firmware on all affected D\u2011Link devices to a version released after 20260205 that resolves the stack buffer overflow in download_mgr.cgi.", "If a firmware update is not available, block or filter external access to the device\u2019s web interface, or disable the download manager feature until a patch can be applied.", "Apply network segmentation or firewall rules to limit inbound connections to the device\u2019s management ports from untrusted networks.", "Continuously monitor device logs for anomalous behavior that may indicate an attempted exploitation or compromise."], "summary": {"action": "Apply Patch", "impact": "Stack-based Buffer Overflow"}, "threat_synthesis": {"affected_systems": "Affected products are listed in the known CNA vendors products field. They include D-Link DNS-120, DNS-1100-4, DNS-1200-05, DNS-1550-04, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-202L, DNR-322L, DNR-326, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-343, DNS-345, DNS-726-4, and related devices such as DNR-202L and DNR-326. The firmware versions up to 20260205 are vulnerable; no data is provided for later versions, so the vulnerability may not affect releases newer than that date.", "description_and_impact": "Key detail from CVE description: a stack-based buffer overflow occurs in the Downloads_Schedule_Info function of /cgi-bin/download_mgr.cgi on D-Link devices. The vulnerability can be triggered remotely by sending a crafted request. While the CVE notes the presence of a stack overflow, the actual consequence of the overflow (such as code execution) is not explicitly stated in the data. Based on the nature of stack overflows, it is inferred that an attacker could potentially manipulate the program\u2019s control flow, which may lead to escalation of privileges or compromise of the device.", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring access to the device\u2019s web interface to send a malicious request to /cgi-bin/download_mgr.cgi. The stack-based buffer overflow can potentially allow an attacker to overwrite return addresses or other control data, and while the CVE does not confirm code execution, such an exploit path is a reasonable inference based on the weakness type (CWE-119, CWE-121, CWE-787)."}}}}, "created": "2026-03-16T09:58:34.000568+00:00", "updated": "2026-03-23T14:00:37.794348+00:00", "vendors": ["d-link", "d-link$PRODUCT$dnr-202l", "d-link$PRODUCT$dnr-322l", "d-link$PRODUCT$dnr-326", "d-link$PRODUCT$dns-1100-4", "d-link$PRODUCT$dns-120", "d-link$PRODUCT$dns-1200-05", "d-link$PRODUCT$dns-1550-04", "d-link$PRODUCT$dns-315l", "d-link$PRODUCT$dns-320", "d-link$PRODUCT$dns-320l", "d-link$PRODUCT$dns-320lw", "d-link$PRODUCT$dns-321", "d-link$PRODUCT$dns-323", "d-link$PRODUCT$dns-325", "d-link$PRODUCT$dns-326", "d-link$PRODUCT$dns-327l", "d-link$PRODUCT$dns-340l", "d-link$PRODUCT$dns-343", "d-link$PRODUCT$dns-345", "d-link$PRODUCT$dns-726-4"]}