CVE-2026-5311
D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
MEDIUM 5.5EPSS 1.3%
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
- Affected
- D-Link · DNS-120 · DNR-202L · DNS-315L · DNS-320 · DNS-320L · DNS-320LW
- CVSS v4.0 VULDB
- 5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULDB
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0 VULDB
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 1.32% chance of exploitation in the next 30 days, 70th percentile
- Published
- 2026-04-01
- Updated
- 2026-04-02
Proof-of-concept exploits (1)
- wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md27★ · 2026-09-15