Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-4213: D-Link DNS Routers: Remote Attack Possible Through Web Interface

CVE-2026-4213 · published 7 months ago

Summary

Certain D-Link DNS routers have a security flaw that can be exploited remotely, potentially allowing an attacker to access and take control of the device. This vulnerability affects multiple D-Link models and has already been publicly disclosed, making it a priority to update the software to prevent potential attacks. Affected users should contact D-Link or their network administrator to apply a security patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dlink	dnr-202l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dnr-202l_firmware::::::::`
dlink	dnr-326_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dnr-326_firmware::::::::`
dlink	dns-1100-4_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1100-4_firmware::::::::`
dlink	dns-120_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-120_firmware::::::::`
dlink	dns-1200-05_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1200-05_firmware::::::::`
dlink	dns-1550-04_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-1550-04_firmware::::::::`
dlink	dns-315l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-315l_firmware::::::::`
dlink	dns-320_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320_firmware::::::::`
dlink	dns-320l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320l_firmware::::::::`
dlink	dns-320lw_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-320lw_firmware::::::::`
dlink	dns-321_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-321_firmware::::::::`
dlink	dns-322l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-322l_firmware::::::::`
dlink	dns-323_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-323_firmware::::::::`
dlink	dns-325_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-325_firmware::::::::`
dlink	dns-326_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-326_firmware::::::::`
dlink	dns-327l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-327l_firmware::::::::`
dlink	dns-340l_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-340l_firmware::::::::`
dlink	dns-343_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-343_firmware::::::::`
dlink	dns-345_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-345_firmware::::::::`
dlink	dns-726-4_firmware	<= 2026-02-05 `cpe:2.3:o:dlink:dns-726-4_firmware::::::::`

Original advisory text

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

References

https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_162/162.md Exploit Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_163/163.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.351124 Permissions Required VDB Entry
https://vuldb.com/?id.351124 Third Party Advisory VDB Entry
https://vuldb.com/?submit.770443 Third Party Advisory VDB Entry
https://vuldb.com/?submit.770444 Third Party Advisory VDB Entry
https://www.dlink.com/ Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-121Stack-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published16 Mar 2026

Updated4 Nov 2026

First seen19 Mar 2026

Sources

CVE-2026-4213 · NVD

Track software like this

Free during beta