CVE-2026-4210
Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi.
Does this matter?
Lower severity and a low EPSS score (3.92%). Track it; it rarely justifies an emergency change on its own.
Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.92% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-77
- Affected
- dlink/dnr-202l firmware · dlink/dnr-326 firmware · dlink/dns-1100-4 firmware · dlink/dns-120 firmware · dlink/dns-1200-05 firmware · dlink/dns-1550-04 firmware · dlink/dns-315l firmware · dlink/dns-320 firmware · dlink/dns-320l firmware · dlink/dns-320lw firmware · dlink/dns-321 firmware · dlink/dns-322l firmware · dlink/dns-323 firmware · dlink/dns-325 firmware · dlink/dns-326 firmware · dlink/dns-327l firmware · dlink/dns-340l firmware · dlink/dns-343 firmware · dlink/dns-345 firmware · dlink/dns-726-4 firmware
- Source
- cna@vuldb.com
References
- https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_159/159.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.351121Permissions Required, VDB Entry
- https://vuldb.com/?id.351121Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.770440Third Party Advisory, VDB Entry
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.