Description
A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this vulnerability is the function FMT_restart/Status_HDInfo/SMART_List/ScanDisk_info/ScanDisk/volume_status/Get_Volume_Mapping/FMT_check_disk_remount_state/FMT_rebuildinfo/FMT_result_list/FMT_result_list_phy/FMT_get_dminfo/FMT_manually_rebuild_info/Get_current_raidtype of the file /cgi-bin/dsk_mgr.cgi. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Affected products
dlink: dns-1550-04 firmware; dlink: dns-1550-04; dlink: dns-315l firmware; dlink: dns-315l; dlink: dns-320 firmware; dlink: dns-320; dlink: dns-320l firmware; dlink: dns-320l; dlink: dns-320lw firmware; dlink: dns-320lw; dlink: dns-321 firmware; dlink: dns-321; dlink: dns-322l firmware; dlink: dns-322l; dlink: dns-323 firmware
References7
- github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_172/172.md ExploitThird Party Advisory
- github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_173/173.md ExploitThird Party Advisory
- vuldb.com/submit/780442 Third Party AdvisoryVDB Entry
- vuldb.com/submit/780443 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/354641 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/354641/cti Permissions RequiredVDB Entry
- www.dlink.com/ Product
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 4.0
-
5.5
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 47 · as of 12 November 2026
- CWE
- CWE-266CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.