CVE-2026-5311
MEDIUMD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
Title source: cnaDescription
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-354640 | D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
https://vuldb.com/vuln/354640
Signature, Permissions Required signature
permissions-required
VDB-354640 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/354640/cti
Third Party Advisory third-party-advisory
Submit #780441 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05/1550-04 up to 20260205 Improper Access Controls
https://vuldb.com/submit/780441
Product product
https://www.dlink.com/
Scores
CVSS v3
5.3
EPSS
0.0099
EPSS Percentile
57.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-266
CWE-284
Status
published
Products (40)
D-Link/DNR-202L
20260205
D-Link/DNR-322L
20260205
D-Link/DNR-326
20260205
D-Link/DNS-1100-4
20260205
D-Link/DNS-120
20260205
D-Link/DNS-1200-05
20260205
D-Link/DNS-1550-04
20260205
D-Link/DNS-315L
20260205
D-Link/DNS-320
20260205
D-Link/DNS-320L
20260205
... and 30 more
Published
Apr 01, 2026
Tracked Since
Apr 02, 2026