CVE-2026-4196
Description
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_recovery/cgi_backup_now/cgi_set_schedule/cgi_set_rsync_server of the file /cgi-bin/remote_backup.cgi. The manipulation leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dlink dns-1550-04_firmware | v ≤ 2026-02-05 | — |
| dlink dns-315l_firmware | v ≤ 2026-02-05 | — |
| dlink dns-320_firmware | v ≤ 2026-02-05 | — |
| dlink dns-320l_firmware | v ≤ 2026-02-05 | — |
| dlink dns-320lw_firmware | v ≤ 2026-02-05 | — |
| dlink dns-321_firmware | v ≤ 2026-02-05 | — |
| dlink dns-322l_firmware | v ≤ 2026-02-05 | — |
| dlink dns-323_firmware | v ≤ 2026-02-05 | — |
| dlink dns-325_firmware | v ≤ 2026-02-05 | — |
| dlink dns-326_firmware | v ≤ 2026-02-05 | — |
| dlink dns-327l_firmware | v ≤ 2026-02-05 | — |
| dlink dns-340l_firmware | v ≤ 2026-02-05 | — |
| dlink dns-343_firmware | v ≤ 2026-02-05 | — |
| dlink dns-345_firmware | v ≤ 2026-02-05 | — |
| dlink dns-726-4_firmware | v ≤ 2026-02-05 | — |
| dlink dnr-202l_firmware | v ≤ 2026-02-05 | — |
| dlink dnr-326_firmware | v ≤ 2026-02-05 | — |
| dlink dns-1100-4_firmware | v ≤ 2026-02-05 | — |
| dlink dns-120_firmware | v ≤ 2026-02-05 | — |
| dlink dns-1200-05_firmware | v ≤ 2026-02-05 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.