CVE-2026-5213

HighCVSS 8.8

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.72%

50th percentile - higher than 50% of all known CVEs

Summary

Multiple D-Link device models (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the function cgi_adduser_to_session in the file /cgi-bin/account_mgr.cgi. Manipulation of the read_list argument leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

A remote attacker can exploit this vulnerability to execute arbitrary code on the device, potentially leading to full control of the network device, traffic interception, or further attacks within the network.

Recommendation

Contact the vendor for a firmware update or consider replacing the device with a supported model.

Other vulnerabilities in D-Link

CVE-2026-5211High
Multiple D-Link devices (including DNS-120, DNR-202L, DNS-315L) up to version 20260205 have a stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of /cgi-bin/app_mgr.cgi. Manipulation of the f_dir argument allows remote exploitation.

Original NVD description (English source)

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.