A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function RSS_Get_Update_Status/RSS_Update/RSS_Channel_AutoDownlaod/RSS_Add/RSS_Channel_Item_Downlaod/RSS_History_Item_List/RSS_Item_List of the file /cgi-bin/download_mgr.cgi. The manipulation results in command injection.
The attack may be performed from remote. The exploit has been made public and could be used.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 40
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Dlink Dnr-202l_Firmware
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dnr-202l
cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dnr-326_Firmware
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dnr-326
cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-1100-4_Firmware
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-1100-4
cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-120_Firmware
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-120
cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-1200-05_Firmware
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-1200-05
cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-1550-04_Firmware
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-1550-04
cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-315l_Firmware
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-315l
cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-320_Firmware
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-320
cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-320l_Firmware
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-320l
cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-320lw_Firmware
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-320lw
cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-321_Firmware
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-321
cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-322l_Firmware
cpe:2.3:o:dlink:dns-322l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-322l
cpe:2.3:h:dlink:dns-322l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-323_Firmware
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-323
cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-325_Firmware
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-325
cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-326_Firmware
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-326
cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-327l_Firmware
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-327l
cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-340l_Firmware
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-340l
cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-343_Firmware
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-343
cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-345_Firmware
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-345
cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*
|
— | — |
|
Dlink Dns-726-4_Firmware
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*
|
— |
<= 2026-02-05
|
|
Dlink Dns-726-4
cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*
|
— | — |
References 14
https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_102/102.md
cna@vuldb.com
https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_103/103.md
cna@vuldb.com
https://vuldb.com/?ctiid.351109
cna@vuldb.com
https://vuldb.com/?id.351109
cna@vuldb.com
https://vuldb.com/?submit.769864
cna@vuldb.com
https://vuldb.com/?submit.769865
cna@vuldb.com
https://vuldb.com/?submit.769866
cna@vuldb.com
https://vuldb.com/?submit.769867
cna@vuldb.com
https://vuldb.com/?submit.769868
cna@vuldb.com
https://vuldb.com/?submit.769869
cna@vuldb.com
https://vuldb.com/?submit.769870
cna@vuldb.com
https://vuldb.com/?submit.770363
cna@vuldb.com
https://vuldb.com/?submit.770364
cna@vuldb.com
https://www.dlink.com/
cna@vuldb.com