CVE-2026-4203

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the function cgi_portforwarding_add/cgi_portforwarding_del/cgi_portforwarding_modify/cgi_portforwarding_add_scan/cgi_dhcpd_lease/cgi_ddns/cgi_ip/cgi_dhcpd of the file /cgi-bin/network_mgr.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-77

Affected software

VendorProductVersions
D-LinkDNS-12020260205
D-LinkDNR-202L20260205
D-LinkDNS-315L20260205
D-LinkDNS-32020260205
D-LinkDNS-320L20260205
D-LinkDNS-320LW20260205
D-LinkDNS-32120260205
D-LinkDNR-322L20260205
D-LinkDNS-32320260205
D-LinkDNS-32520260205
D-LinkDNS-32620260205
D-LinkDNS-327L20260205
D-LinkDNR-32620260205
D-LinkDNS-340L20260205
D-LinkDNS-34320260205
D-LinkDNS-34520260205
D-LinkDNS-726-420260205
D-LinkDNS-1100-420260205
D-LinkDNS-1200-0520260205
D-LinkDNS-1550-0420260205

References

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-420306.1MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in CVE-2026-420319.8CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability inCVE-2026-420329.1CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability inCVE-2026-420337.4Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by anyCVE-2026-420345.3Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is byCVE-2026-420357.4Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the AxiCVE-2026-420365.3Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios retCVE-2026-420375.3Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/fCVE-2026-420387.5Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypCVE-2026-420397.5Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects wiCVE-2026-42049.8A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNSCVE-2026-420403.7Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLS
CVE-2026-4203: Critical severity, CVSS 9.8 | Vulnix