CVE-2026-4211
Remote Stack-Based Buffer Overflow in D-Link Local_Backup_Info
Publication date: 2026-03-16
Last updated on: 2026-03-19
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dnr-202l_firmware | to 2026-02-05 (inc) |
| dlink | dnr-326_firmware | to 2026-02-05 (inc) |
| dlink | dns-1100-4_firmware | to 2026-02-05 (inc) |
| dlink | dns-120_firmware | to 2026-02-05 (inc) |
| dlink | dns-1200-05_firmware | to 2026-02-05 (inc) |
| dlink | dns-1550-04_firmware | to 2026-02-05 (inc) |
| dlink | dns-315l_firmware | to 2026-02-05 (inc) |
| dlink | dns-320_firmware | to 2026-02-05 (inc) |
| dlink | dns-320l_firmware | to 2026-02-05 (inc) |
| dlink | dns-320lw_firmware | to 2026-02-05 (inc) |
| dlink | dns-321_firmware | to 2026-02-05 (inc) |
| dlink | dns-322l_firmware | to 2026-02-05 (inc) |
| dlink | dns-323_firmware | to 2026-02-05 (inc) |
| dlink | dns-325_firmware | to 2026-02-05 (inc) |
| dlink | dns-326_firmware | to 2026-02-05 (inc) |
| dlink | dns-327l_firmware | to 2026-02-05 (inc) |
| dlink | dns-340l_firmware | to 2026-02-05 (inc) |
| dlink | dns-343_firmware | to 2026-02-05 (inc) |
| dlink | dns-345_firmware | to 2026-02-05 (inc) |
| dlink | dns-726-4_firmware | to 2026-02-05 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-4211 is a critical stack-based buffer overflow vulnerability found in multiple D-Link NAS devices. It exists in the Local_Backup_Info function of the /cgi-bin/local_backup_mgr.cgi script. The vulnerability arises because the argument f_idx, which is attacker-controlled, is copied into a stack buffer without proper validation or length checks. If an attacker supplies an input longer than the buffer size, it causes a stack overflow, potentially overwriting the function's return address."}, {'type': 'paragraph', 'content': 'This flaw can be exploited remotely without authentication, allowing attackers to crash the device or execute arbitrary code. A proof-of-concept exploit is publicly available, demonstrating how sending a specially crafted POST request with an overly long f_idx parameter can trigger the overflow.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact affected devices by allowing remote attackers to cause denial of service or execute arbitrary code. Exploiting the stack-based buffer overflow can crash the device, making it unavailable and disrupting services.
Additionally, successful exploitation can compromise the confidentiality, integrity, and availability of the device, potentially allowing attackers to take control, manipulate data, or disrupt operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending a specially crafted POST request to the affected device's /cgi-bin/local_backup_mgr.cgi endpoint, specifically targeting the Local_Backup_Info function with an excessively long string in the f_idx parameter."}, {'type': 'paragraph', 'content': "A proof-of-concept involves sending a POST request with a long string of 'a' characters assigned to the f_idx parameter, which causes the device to crash or behave abnormally, indicating the presence of the vulnerability."}, {'type': 'paragraph', 'content': 'Example command using curl to test for the vulnerability:'}, {'type': 'list_item', 'content': 'curl -X POST http://[target-ip]/cgi-bin/local_backup_mgr.cgi -d "f_idx=$(python3 -c \'print("a"*1000)\')"'}, {'type': 'paragraph', 'content': 'If the device crashes, becomes unresponsive, or exhibits denial-of-service symptoms after this request, it is likely vulnerable.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
No known mitigations or countermeasures have been identified for this vulnerability as of the disclosure date.
Due to the critical severity and ease of exploitation, the recommended immediate step is to replace the affected D-Link devices with alternative products that are not vulnerable.
Additionally, restricting network access to the affected devices, especially blocking remote access to the /cgi-bin/local_backup_mgr.cgi endpoint, may reduce exposure until replacement or patching is possible.