D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection (D-Link DNS-120)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.99 % · percentile 90 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- VulDB
- NVD status
- Analyzed
Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function cgi_tm_set_share of the file /cgi-bin/time_machine.cgi. The manipulation of the argument Name results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | MEDIUM 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | LOW 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · cna@vuldb.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-12283
- GCVE · GCVE-0-2026-4210
Affected configurations (NVD CPE)
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*≤ 2026-02-05
Affected products
| Product | Versions |
|---|---|
| D-Link · DNS-120 | affected 20260205 |
| D-Link · DNR-202L | affected 20260205 |
| D-Link · DNS-315L | affected 20260205 |
| D-Link · DNS-320 | affected 20260205 |
| D-Link · DNS-320L | affected 20260205 |
| D-Link · DNS-320LW | affected 20260205 |
| D-Link · DNS-321 | affected 20260205 |
| D-Link · DNR-322L | affected 20260205 |
| D-Link · DNS-323 | affected 20260205 |
| D-Link · DNS-325 | affected 20260205 |
| D-Link · DNS-326 | affected 20260205 |
| D-Link · DNS-327L | affected 20260205 |
| D-Link · DNR-326 | affected 20260205 |
| D-Link · DNS-340L | affected 20260205 |
| D-Link · DNS-343 | affected 20260205 |
| D-Link · DNS-345 | affected 20260205 |
| D-Link · DNS-726-4 | affected 20260205 |
| D-Link · DNS-1100-4 | affected 20260205 |
| D-Link · DNS-1200-05 | affected 20260205 |
| D-Link · DNS-1550-04 | affected 20260205 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |