CVE-2026-4195 is a command injection flaw (CVSS 6.3) in the wizard_mgr.cgi file of many D-Link DNS NAS and DNR recorder models, firmware up to 20260205. The record says the attack can be remote and the exploit is published. Check D-Link's advisory and restrict access.
What's affected
The NVD record lists these models: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04, up to firmware dated 20260205. The affected file is /cgi-bin/wizard_mgr.cgi.
The record does not state a fixed firmware, nor whether these models are supported. I could not load the pages it references, so check D-Link's support site for the current status of each model.
How to check if you're exposed
Find D-Link storage and recorder devices on your network, and read the model and firmware date on the admin page. Compare the firmware date against 20260205. Then check whether the web interface is reachable from the internet through port forwarding, remote access features or cloud relay settings.
A network scan of your own address ranges for D-Link web interfaces helps find forgotten devices.
What to do now
- Check D-Link's support site for firmware or an end of life notice for each model you own.
- Remove the device's web interface from the internet and from untrusted network segments.
- Put NAS devices on a restricted network segment, reachable only from the machines that need them.
- Back up the data on these devices to a second location now, in case you need to replace or reset them.
- If a model has no fix, plan its replacement.
Why it matters
The record lists CWE-74, injection, and CWE-77, command injection. Command injection in a CGI script means input from a request reaches a shell command on the device.
The score is moderate because the vector shows low privileges are required. That still matters on a NAS, which often holds backups and shared files. The record says an exploit is public, and does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is every one of these models still supported?
The record does not say. Check D-Link's pages for each model, and plan replacement for any that are retired.
Sources
Last reviewed: 19 October 2026.
