VDB

CVE-2026-4194

CVE-2026-4194 PUBLISHED CVSS 6.900000095367432 MEDIUM

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file /cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

EPSS 0.12% · 29.8th percentile

Risk Scores

CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS Score
0.12%
29.8th percentile

Affected Products

VendorProductVersions
D-LinkDNS-320LW20260205, 20260205, 20260205
dlinkdns-320l_firmware0, 0, 0
D-LinkDNS-32020260205, 20260205, 20260205
dlinkdns-120_firmware0, 0, 0
dlinkdns-323_firmware0, 0, 0
D-LinkDNS-726-420260205, 20260205, 20260205
D-LinkDNS-1550-0420260205, 20260205, 20260205
D-LinkDNS-32120260205, 20260205, 20260205
D-LinkDNS-1200-0520260205, 20260205, 20260205
dlinkdns-322l_firmware0, 0, 0
D-LinkDNR-32620260205, 20260205, 20260205
D-LinkDNS-34320260205, 20260205, 20260205
dlinkdnr-202l_firmware0, 0, 0
dlinkdns-320lw_firmware0, 0, 0
D-LinkDNS-32620260205, 20260205, 20260205
dlinkdns-343_firmware0, 0, 0
D-LinkDNS-32520260205, 20260205, 20260205
D-LinkDNS-340L20260205, 20260205, 20260205
D-LinkDNS-320L20260205, 20260205, 20260205
dlinkdns-345_firmware0, 0, 0

…and 20 more

Timeline

  • Mar 15, 2026 CVE Published
  • Mar 16, 2026 EPSS Score
  • Mar 16, 2026 CVE Updated
  • Mar 17, 2026 EPSS Score
  • Mar 17, 2026 Coalition ESS Score
  • Mar 18, 2026 EPSS Score
  • Mar 19, 2026 EPSS Score
  • Mar 20, 2026 EPSS Score
  • Mar 20, 2026 PoC Published
  • Mar 21, 2026 EPSS Score
  • Mar 22, 2026 EPSS Score
  • Mar 23, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›