CVE-2026-4214
Remote Stack-Based Buffer Overflow in D-Link UPnP CGI Module
Publication date: 2026-03-16
Last updated on: 2026-03-19
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dnr-202l_firmware | to 2026-02-05 (inc) |
| dlink | dnr-326_firmware | to 2026-02-05 (inc) |
| dlink | dns-1100-4_firmware | to 2026-02-05 (inc) |
| dlink | dns-120_firmware | to 2026-02-05 (inc) |
| dlink | dns-1200-05_firmware | to 2026-02-05 (inc) |
| dlink | dns-1550-04_firmware | to 2026-02-05 (inc) |
| dlink | dns-315l_firmware | to 2026-02-05 (inc) |
| dlink | dns-320_firmware | to 2026-02-05 (inc) |
| dlink | dns-320l_firmware | to 2026-02-05 (inc) |
| dlink | dns-320lw_firmware | to 2026-02-05 (inc) |
| dlink | dns-321_firmware | to 2026-02-05 (inc) |
| dlink | dns-322l_firmware | to 2026-02-05 (inc) |
| dlink | dns-323_firmware | to 2026-02-05 (inc) |
| dlink | dns-325_firmware | to 2026-02-05 (inc) |
| dlink | dns-326_firmware | to 2026-02-05 (inc) |
| dlink | dns-327l_firmware | to 2026-02-05 (inc) |
| dlink | dns-340l_firmware | to 2026-02-05 (inc) |
| dlink | dns-343_firmware | to 2026-02-05 (inc) |
| dlink | dns-345_firmware | to 2026-02-05 (inc) |
| dlink | dns-726-4_firmware | to 2026-02-05 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-4214 is a stack-based buffer overflow vulnerability found in multiple D-Link NAS and router device models. It exists in the UPnP_AV_Server_Path_Setting function within the /cgi-bin/app_mgr.cgi script. The vulnerability occurs because the parameter `f_dir`, which is controlled by an attacker, is copied into a local stack variable without proper length validation. If an attacker supplies an excessively long input for `f_dir`, it causes a stack overflow that can overwrite the function's return address."}, {'type': 'paragraph', 'content': 'This flaw allows a remote attacker to crash the device or potentially execute arbitrary code remotely by sending a specially crafted POST request to the vulnerable CGI script.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including crashing the affected device, causing denial of service, and potentially allowing remote code execution by an attacker.
- Denial of Service (DoS): The device can become unresponsive or crash, disrupting network storage or routing services.
- Remote Code Execution (RCE): An attacker may execute arbitrary code on the device remotely, potentially gaining control over it.
- Compromise of Confidentiality, Integrity, and Availability: The attacker could manipulate or access sensitive data, alter device behavior, or disrupt services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending a crafted POST request to the affected device's /cgi-bin/app_mgr.cgi endpoint, specifically targeting the UPnP_AV_Server_Path_Setting function."}, {'type': 'paragraph', 'content': 'A proof-of-concept involves sending a POST request with the parameter cmd=UPnP_AV_Server_Path_Setting and an excessively long string assigned to the parameter f_dir. This causes a stack-based buffer overflow, which may crash the device or cause it to become unresponsive.'}, {'type': 'paragraph', 'content': 'A sample command using curl to test for the vulnerability could be:'}, {'type': 'list_item', 'content': 'curl -X POST http://[target-ip]/cgi-bin/app_mgr.cgi -d "cmd=UPnP_AV_Server_Path_Setting&f_dir=$(python3 -c \'print("a"*1000)\')"'}, {'type': 'paragraph', 'content': 'If the device crashes or becomes unresponsive after this request, it indicates the presence of the vulnerability.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
No known mitigations or countermeasures have been published for this vulnerability.
The recommended immediate step is to replace affected devices with alternative products that are not vulnerable.
Additionally, restricting network access to the affected devices, especially blocking remote access to the /cgi-bin/app_mgr.cgi endpoint, may reduce exposure.