CVE-2026-4213Disclosure(dlink / dnr-202l)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for dlink dnr-202l systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

4.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-119CWE-121CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • dnr-202l
  • dnr-202l_firmware
  • dnr-326
  • dnr-326_firmware

Threat summary

  • Public PoC and exploit tooling are both present
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 4 mentions (2026-03-16); latest day: 1
  • 5 total mentions across 2 days

Affected systems

Vendors
Products
dnr-202ldnr-202l_firmwarednr-326dnr-326_firmwaredns-1100-4dns-1100-4_firmwaredns-120dns-1200-05dns-1200-05_firmwaredns-120_firmware

1 version affected across 40 products

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-03-16: 4Mentions · 2026-03-17: 1PoC Mentioned / Linked · 2026-03-16: 1Exploit Tool / Code · 2026-03-16: 1Technical Details · 2026-03-16: 203-1603-17
Signal classification3 categories
Disclosure
360.0%
Exploit
120.0%
General
120.0%
Referenced assets11 URLs
Classification over time
DateTotalLabels
2026-03-164
Disclosure3Exploit1
2026-03-171
General1
Full discourse5 posts
  • CVE@CVEnew
    General

    CVE-2026-4213 A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-3… https://www.cve.org/CVERecord?id=CVE-2026-4213

    Post summary

    A brief notice that CVE-2026-4213 affects multiple D-Link router models with no additional technical or exploit details provided.

    00000165
    56.7K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-4213 - High A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, D... https://www.thehackerwire.com/vulnerability/CVE-2026-4213/ https://t.co/aG7i0Jpnlb

    Post summary

    The post announces CVE-2026-4213 as a high‑severity issue affecting multiple D‑Link DNS routers and provides links to further information.

    0000056
    136 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-4213 - High A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, D... https://www.thehackerwire.com/vulnerability/CVE-2026-4213/ https://t.co/lNXbq7QuHj

    Post summary

    A brief alert announcing CVE-2026-4213, a high‑severity vulnerability affecting several D‑Link models, with no PoC, exploit, patch, or active exploitation details provided.

    0000042
    136 followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-4213: HIGH] Critical vulnerability detected in multiple D-Link products up to 20260205 version. Affects cgi_myfavorite_del_user/cgi_myfavorite_verify in gui_mgr.cgi file, leading to a remote stack-ba...#cve,CVE-2026-4213,#cybersecurity https://cvefind.com/CVE-2026-4213

    Post summary

    The post announces a high‑severity stack‑based vulnerability (CVE‑2026‑4213) in D‑Link products but lacks details on exploitation, remediation, or proven real‑world attacks.

    0000037
    601 followersView on X
  • dbugs@ptdbugs
    Exploit

    D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow CVE: CVE-2026-4213 Vendor: D-link Product: DNS-120 CVSS: 8.7 Credits: pjqwudi (VulDB User) Description: A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-4213 • https://vuldb.com/?id.351124 • https://vuldb.com/?ctiid.351124 • https://vuldb.com/?submit.770443 • https://vuldb.com/?submit.770444 • https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_162/162.md • https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_163/163.md • https://www.dlink.com/ #dbugs_vuln

    Post summary

    A stack-based buffer overflow in multiple D‑Link DNS routers (CVE‑2026‑4213) is publicly exploitable. No evidence of current in‑the‑wild attacks is provided, but the CVSS is high (8.7).

    00000108
    612 followersView on X
CPE platform detail40 entries

40 of 40 entries

PartVendorProductVersionTarget SWTarget HW
HWdlinkdnr-202l---
OSdlinkdnr-202l_firmware---
HWdlinkdnr-326---
OSdlinkdnr-326_firmware---
HWdlinkdns-1100-4---
OSdlinkdns-1100-4_firmware---
HWdlinkdns-120---
HWdlinkdns-1200-05---
OSdlinkdns-1200-05_firmware---
OSdlinkdns-120_firmware---
HWdlinkdns-1550-04---
OSdlinkdns-1550-04_firmware---
HWdlinkdns-315l---
OSdlinkdns-315l_firmware---
HWdlinkdns-320---
OSdlinkdns-320_firmware---
HWdlinkdns-320l---
OSdlinkdns-320l_firmware---
HWdlinkdns-320lw---
OSdlinkdns-320lw_firmware---
HWdlinkdns-321---
OSdlinkdns-321_firmware---
HWdlinkdns-322l---
OSdlinkdns-322l_firmware---
HWdlinkdns-323---
OSdlinkdns-323_firmware---
HWdlinkdns-325---
OSdlinkdns-325_firmware---
HWdlinkdns-326---
OSdlinkdns-326_firmware---
HWdlinkdns-327l---
OSdlinkdns-327l_firmware---
HWdlinkdns-340l---
OSdlinkdns-340l_firmware---
HWdlinkdns-343---
OSdlinkdns-343_firmware---
HWdlinkdns-345---
OSdlinkdns-345_firmware---
HWdlinkdns-726-4---
OSdlinkdns-726-4_firmware---

Explore more