CVEvulnerability

CVE-2026-5311

5.5 MEDIUM Published 2026-04-01 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-04-01
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.5 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-266, CWE-284

Description

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected configurations

• dlink dnr-202l firmware (<= 2026-02-05) • dlink dnr-326 firmware (<= 2026-02-05) • dlink dns-1100-4 firmware (<= 2026-02-05) • dlink dns-120 firmware (<= 2026-02-05) • dlink dns-1200-05 firmware (<= 2026-02-05) • dlink dns-1550-04 firmware (<= 2026-02-05) • dlink dns-315l firmware (<= 2026-02-05) • dlink dns-320 firmware (<= 2026-02-05) • dlink dns-320l firmware (<= 2026-02-05) • dlink dns-320lw firmware (<= 2026-02-05) • dlink dns-321 firmware (<= 2026-02-05) • dlink dns-322l firmware (<= 2026-02-05) • dlink dns-323 firmware (<= 2026-02-05) • dlink dns-325 firmware (<= 2026-02-05) • dlink dns-326 firmware (<= 2026-02-05) • dlink dns-327l firmware (<= 2026-02-05) • dlink dns-340l firmware (<= 2026-02-05) • dlink dns-343 firmware (<= 2026-02-05) • dlink dns-345 firmware (<= 2026-02-05) • dlink dns-726-4 firmware (<= 2026-02-05)

Related

Weakness · CWE (2)

  • CWE-266 Incorrect Privilege Assignment weakness
  • CWE-284 Improper Access Control weakness

References