Description
A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected products
dlink: dnr-202l firmware; dlink: dnr-202l; dlink: dnr-326 firmware; dlink: dnr-326; dlink: dns-1100-4 firmware; dlink: dns-1100-4; dlink: dns-120 firmware; dlink: dns-120; dlink: dns-1200-05 firmware; dlink: dns-1200-05; dlink: dns-1550-04 firmware; dlink: dns-1550-04; dlink: dns-315l firmware; dlink: dns-315l; dlink: dns-320 firmware
References5
- github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md ExploitThird Party Advisory
- vuldb.com/submit/780441 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/354640 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/354640/cti Permissions RequiredVDB Entry
- www.dlink.com/ Product
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 4.0
-
5.5
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 64 · as of 12 November 2026
- CWE
- CWE-266CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.