CVE-2026-5211

HighCVSS 8.8

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.70%

49th percentile - higher than 49% of all known CVEs

Summary

Multiple D-Link devices (including DNS-120, DNR-202L, DNS-315L) up to version 20260205 have a stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of /cgi-bin/app_mgr.cgi. Manipulation of the f_dir argument allows remote exploitation.

Risk Assessment

A remote attacker can exploit this vulnerability to take control of the device or cause a crash, posing a serious risk to network security.

Recommendation

Immediately update the firmware of affected D-Link devices to the latest version or apply available security patches.

Other vulnerabilities in D-Link

CVE-2026-5213High
Multiple D-Link device models (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the function cgi_adduser_to_session in the file /cgi-bin/account_mgr.cgi. Manipulation of the read_list argument leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

Original NVD description (English source)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function UPnP_AV_Server_Path_Del of the file /cgi-bin/app_mgr.cgi. Executing a manipulation of the argument f_dir can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.