CVE-2026-5311

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - cna@vuldb.com

Published

2026-04-01

Last modified

2026-10-26

Weaknesses

CWE-266, CWE-284

Affected products

• Dnr-202l (D-link)
• Dnr-322l (D-link)
• Dnr-326 (D-link)
• Dns-1100-4 (D-link)
• Dns-120 (D-link)
• Dns-1200-05 (D-link)
• Dns-1550-04 (D-link)
• Dns-315l (D-link)
• Dns-320 (D-link)
• Dns-320l (D-link)
• Dns-320lw (D-link)
• Dns-321 (D-link)
• Dns-323 (D-link)
• Dns-325 (D-link)
• Dns-326 (D-link)
• Dns-327l (D-link)
• Dns-340l (D-link)
• Dns-343 (D-link)
• Dns-345 (D-link)
• Dns-726-4 (D-link)
• Dnr-202l Firmware (Dlink)
• Dnr-326 Firmware (Dlink)
• Dns-1100-4 Firmware (Dlink)
• Dns-1200-05 Firmware (Dlink)
• Dns-120 Firmware (Dlink)
• Dns-1550-04 Firmware (Dlink)
• Dns-315l Firmware (Dlink)
• Dns-320 Firmware (Dlink)
• Dns-320l Firmware (Dlink)
• Dns-320lw Firmware (Dlink)
• Dns-321 Firmware (Dlink)
• Dns-322l Firmware (Dlink)
• Dns-323 Firmware (Dlink)
• Dns-325 Firmware (Dlink)
• Dns-326 Firmware (Dlink)
• Dns-327l Firmware (Dlink)
• Dns-340l Firmware (Dlink)
• Dns-343 Firmware (Dlink)
• Dns-345 Firmware (Dlink)
• Dns-726-4 Firmware (Dlink)

References

• https://vuldb.com/vuln/354640
• https://vuldb.com/vuln/354640/cti
• https://vuldb.com/submit/780441
• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md
• https://www.dlink.com/