CVE-2026-5311

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266CWE-284

Affected software

VendorProductVersions
D-LinkDNS-12020260205
D-LinkDNR-202L20260205
D-LinkDNS-315L20260205
D-LinkDNS-32020260205
D-LinkDNS-320L20260205
D-LinkDNS-320LW20260205
D-LinkDNS-32120260205
D-LinkDNR-322L20260205
D-LinkDNS-32320260205
D-LinkDNS-32520260205
D-LinkDNS-32620260205
D-LinkDNS-327L20260205
D-LinkDNR-32620260205
D-LinkDNS-340L20260205
D-LinkDNS-34320260205
D-LinkDNS-34520260205
D-LinkDNS-726-420260205
D-LinkDNS-1100-420260205
D-LinkDNS-1200-0520260205
D-LinkDNS-1550-0420260205

References

Timeline

Published
Apr 1, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-531107.8In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390xCVE-2026-531115.5In the Linux kernel, the following vulnerability has been resolved: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_pCVE-2026-531127.8In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irCVE-2026-531135.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leaks in beacon template setup The functions CVE-2026-531145.5In the Linux kernel, the following vulnerability has been resolved: perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handleCVE-2026-531157.8In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver CVE-2026-531167.8In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks CVE-2026-531177.8In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is CVE-2026-531187.8In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_override infrastructure When a driver is probCVE-2026-531197.8In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driverCVE-2026-53125.3A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNSCVE-2026-531207.8In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probe
CVE-2026-5311: Medium severity, CVSS 5.3 | Vulnix