D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection (D-Link DNS-120)

CVE-2026-4210

MEDIUM 5.3

En bref

Source: NVD
EPSS: EPSS 3.99 % · centile 90 (2026-10-29)
État: PUBLISHED
Publiée: 2026-03-16 03:02 UTC
Mise à jour: 2026-03-16 15:31 UTC
Attribuée par: VulDB
Statut NVD: Analyzed

Rechercher sur…

Description

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Faiblesses (CWE)

CWE-77 — Injection de commande
CWE-74 — Neutralisation incorrecte d'éléments spéciaux (injection)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	MEDIUM 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
CVSS 3.1	MEDIUM 6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
CVSS 3.0	MEDIUM 6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
CVSS 2.0	MEDIUM 6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB
CVSS 4.0	LOW 2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · cna@vuldb.com (Secondary)
CVSS 3.1	MEDIUM 6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	NVD · cna@vuldb.com (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P	NVD · cna@vuldb.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-12283
GCVE · GCVE-0-2026-4210

Configurations affectées (CPE NVD)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05

Produits affectés

Produit	Versions
D-Link · DNS-120	affected 20260205
D-Link · DNR-202L	affected 20260205
D-Link · DNS-315L	affected 20260205
D-Link · DNS-320	affected 20260205
D-Link · DNS-320L	affected 20260205
D-Link · DNS-320LW	affected 20260205
D-Link · DNS-321	affected 20260205
D-Link · DNR-322L	affected 20260205
D-Link · DNS-323	affected 20260205
D-Link · DNS-325	affected 20260205
D-Link · DNS-326	affected 20260205
D-Link · DNS-327L	affected 20260205
D-Link · DNR-326	affected 20260205
D-Link · DNS-340L	affected 20260205
D-Link · DNS-343	affected 20260205
D-Link · DNS-345	affected 20260205
D-Link · DNS-726-4	affected 20260205
D-Link · DNS-1100-4	affected 20260205
D-Link · DNS-1200-05	affected 20260205
D-Link · DNS-1550-04	affected 20260205

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection (D-Link DNS-120)