CVE-2026-5311

D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control

MEDIUM 6.9

At a glance

Source: NVD
EPSS: EPSS 0.99 % · percentile 62 (2026-10-28)
State: PUBLISHED
Published: 2026-04-01 19:45 UTC
Updated: 2026-04-02 15:27 UTC
Assigner: VulDB
NVD status: Analyzed

Description

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Weaknesses (CWE)

CWE-284 — Improper Access Control
CWE-266 — Incorrect Privilege Assignment

References

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
CVSS 3.0	MEDIUM 5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB
CVSS 4.0	MEDIUM 5.5	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · cna@vuldb.com (Secondary)
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · cna@vuldb.com (Secondary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	NVD · cna@vuldb.com (Secondary)

European references

ENISA EUVD · EUVD-2026-18023
GCVE · GCVE-0-2026-5311

Affected configurations (NVD CPE)

cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:* ≤ 2026-02-05

Affected products

Product	Versions
D-Link · DNS-120	affected 20260205
D-Link · DNR-202L	affected 20260205
D-Link · DNS-315L	affected 20260205
D-Link · DNS-320	affected 20260205
D-Link · DNS-320L	affected 20260205
D-Link · DNS-320LW	affected 20260205
D-Link · DNS-321	affected 20260205
D-Link · DNR-322L	affected 20260205
D-Link · DNS-323	affected 20260205
D-Link · DNS-325	affected 20260205
D-Link · DNS-326	affected 20260205
D-Link · DNS-327L	affected 20260205
D-Link · DNR-326	affected 20260205
D-Link · DNS-340L	affected 20260205
D-Link · DNS-343	affected 20260205
D-Link · DNS-345	affected 20260205
D-Link · DNS-726-4	affected 20260205
D-Link · DNS-1100-4	affected 20260205
D-Link · DNS-1200-05	affected 20260205
D-Link · DNS-1550-04	affected 20260205

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD