Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-4211: D-Link NAS Devices: Remote Attack Possible through Backup Function

CVE-2026-4211 · published 7 months ago

Summary

D-Link network-attached storage (NAS) devices are at risk of a remote attack through their backup function. If exploited, this could lead to unauthorized access and potentially allow an attacker to take control of the device. To mitigate this risk, users should update their devices to the latest firmware version available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dlink	dnr-202l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dnr-202l_firmware::::::::`
dlink	dnr-326_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dnr-326_firmware::::::::`
dlink	dns-1100-4_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1100-4_firmware::::::::`
dlink	dns-120_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-120_firmware::::::::`
dlink	dns-1200-05_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1200-05_firmware::::::::`
dlink	dns-1550-04_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1550-04_firmware::::::::`
dlink	dns-315l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-315l_firmware::::::::`
dlink	dns-320_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320_firmware::::::::`
dlink	dns-320l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320l_firmware::::::::`
dlink	dns-320lw_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320lw_firmware::::::::`
dlink	dns-321_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-321_firmware::::::::`
dlink	dns-322l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-322l_firmware::::::::`
dlink	dns-323_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-323_firmware::::::::`
dlink	dns-325_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-325_firmware::::::::`
dlink	dns-326_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-326_firmware::::::::`
dlink	dns-327l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-327l_firmware::::::::`
dlink	dns-340l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-340l_firmware::::::::`
dlink	dns-343_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-343_firmware::::::::`
dlink	dns-345_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-345_firmware::::::::`
dlink	dns-726-4_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-726-4_firmware::::::::`

Original advisory text

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this issue is the function Local_Backup_Info of the file /cgi-bin/local_backup_mgr.cgi. This manipulation of the argument f_idx causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

References

https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_160/160.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.351122 Permissions Required VDB Entry
https://vuldb.com/?id.351122 Third Party Advisory VDB Entry
https://vuldb.com/?submit.770441 Third Party Advisory VDB Entry
https://www.dlink.com/ Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-121Stack-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published16 Mar 2026

Updated4 Nov 2026

First seen19 Mar 2026

Sources

CVE-2026-4211 · NVD

Track software like this

Free during beta