D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control (D-Link DNS-120)
En bref
- Source
- NVD
- EPSS
- EPSS 0.55 % · centile 46 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulDB
- Statut NVD
- Analyzed
Description
A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function FMT_restart/Status_HDInfo/SMART_List/ScanDisk_info/ScanDisk/volume_status/Get_Volume_Mapping/FMT_check_disk_remount_state/FMT_rebuildinfo/FMT_result_list/FMT_result_list_phy/FMT_get_dminfo/FMT_manually_rebuild_info/Get_current_raidtype of the file /cgi-bin/dsk_mgr.cgi. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | MEDIUM 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · cna@vuldb.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · cna@vuldb.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-18069
- GCVE · GCVE-0-2026-5312
Configurations affectées (CPE NVD)
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05
Produits affectés
| Produit | Versions |
|---|---|
| D-Link · DNS-120 | affected 20260205 |
| D-Link · DNR-202L | affected 20260205 |
| D-Link · DNS-315L | affected 20260205 |
| D-Link · DNS-320 | affected 20260205 |
| D-Link · DNS-320L | affected 20260205 |
| D-Link · DNS-320LW | affected 20260205 |
| D-Link · DNS-321 | affected 20260205 |
| D-Link · DNR-322L | affected 20260205 |
| D-Link · DNS-323 | affected 20260205 |
| D-Link · DNS-325 | affected 20260205 |
| D-Link · DNS-326 | affected 20260205 |
| D-Link · DNS-327L | affected 20260205 |
| D-Link · DNR-326 | affected 20260205 |
| D-Link · DNS-340L | affected 20260205 |
| D-Link · DNS-343 | affected 20260205 |
| D-Link · DNS-345 | affected 20260205 |
| D-Link · DNS-726-4 | affected 20260205 |
| D-Link · DNS-1100-4 | affected 20260205 |
| D-Link · DNS-1200-05 | affected 20260205 |
| D-Link · DNS-1550-04 | affected 20260205 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |