CVE-2026-4194

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file /cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-419409.8cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attaCVE-2026-419479.1Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace conCVE-2026-419489.4Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to theCVE-2026-419497.5Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user toCVE-2026-41959.8A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNSCVE-2026-419506.5Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of filesCVE-2026-419518.6Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the serveCVE-2026-419527.8Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before buCVE-2026-419538.7A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role canCVE-2026-419544.9Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may alloCVE-2026-419567.5When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM)CVE-2026-419578.8An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.  No
CVE-2026-4194: Critical severity, CVSS 9.8 | Vulnix