D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control (D-Link DNS-120)
En bref
- Source
- NVD
- EPSS
- EPSS 1.03 % · centile 64 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulDB
- Statut NVD
- Analyzed
Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | MEDIUM 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · cna@vuldb.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · cna@vuldb.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-18023
- GCVE · GCVE-0-2026-5311
Configurations affectées (CPE NVD)
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05
Produits affectés
| Produit | Versions |
|---|---|
| D-Link · DNS-120 | affected 20260205 |
| D-Link · DNR-202L | affected 20260205 |
| D-Link · DNS-315L | affected 20260205 |
| D-Link · DNS-320 | affected 20260205 |
| D-Link · DNS-320L | affected 20260205 |
| D-Link · DNS-320LW | affected 20260205 |
| D-Link · DNS-321 | affected 20260205 |
| D-Link · DNR-322L | affected 20260205 |
| D-Link · DNS-323 | affected 20260205 |
| D-Link · DNS-325 | affected 20260205 |
| D-Link · DNS-326 | affected 20260205 |
| D-Link · DNS-327L | affected 20260205 |
| D-Link · DNR-326 | affected 20260205 |
| D-Link · DNS-340L | affected 20260205 |
| D-Link · DNS-343 | affected 20260205 |
| D-Link · DNS-345 | affected 20260205 |
| D-Link · DNS-726-4 | affected 20260205 |
| D-Link · DNS-1100-4 | affected 20260205 |
| D-Link · DNS-1200-05 | affected 20260205 |
| D-Link · DNS-1550-04 | affected 20260205 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |