CVE-2026-4203 is a command injection flaw in the /cgi-bin/network_mgr.cgi handler of D-Link DNS network storage firmware up to 20260205, scored CVSS 6.3 (medium). I could not confirm a vendor fix. Check D-Link support for your model, and keep the web management interface off the internet until you know.
What's affected
The NVD record lists these D-Link models, all "up to 20260205": DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04. The vulnerable code is in /cgi-bin/network_mgr.cgi, in cgi_portforwarding_add, cgi_portforwarding_del, cgi_portforwarding_modify, cgi_portforwarding_add_scan, cgi_dhcpd_lease, cgi_ddns, cgi_ip and cgi_dhcpd.
The record gives no fixed firmware version, and the references do not include a D-Link advisory that names one. The reporter's write-up says testing used DNS-320 firmware 2.06b01, which it calls the latest version at the time. Treat the other listed models as affected until D-Link says otherwise.
How to check if you're exposed
- Find the model name on the device label or in the web administration page, and compare it with the list above.
- Read the firmware version in the administration page. The record says everything up to 20260205 is affected, so a recent looking version is not proof of safety.
- Look for a firmware download or security notice for your model on the D-Link support site. Since I could not read one, the advisory steps are the authority here.
- From a network outside your own, scan your public address for the management ports. Only do this for addresses you own.
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
If a management port answers from the internet, treat the device as exposed.
What to do now
- List every D-Link NAS on your networks, including ones in branch offices and labs.
- Remove any port forward or cloud relay that publishes the web interface to the internet.
- Limit management access to one admin network or a small set of addresses.
- Apply a firmware update if D-Link has published one for your model.
- If no update exists, plan to replace the device, and copy its data somewhere safe first.
- Remove unused accounts and set strong, unique passwords, because the attack needs a login.
Why it matters
The record classes this as CWE-74 and CWE-77: a request value reaches an operating system command without its special characters being neutralized. The write-up names protocol, e_port, p_port and service as the value passed straight from the request into the affected code. This handler covers port forwarding, DHCP, dynamic DNS and IP settings, so it is one of the larger entry points in the web interface.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That means it is reachable over the network, needs a low privileged login, and needs no user action. The record says the exploit has been disclosed to the public. The KEV flag is false, and I found no report of exploitation in the wild.
Network storage often holds backups and shared files, so a flaw in its web interface deserves attention even at medium scores. For a wider view of old or unpatched components in your estate, run the free in-browser dependency scan on your own software, and browse the Gold directory for related records.
Quick check
Is CVE-2026-4203 exploited in the wild?
The record's KEV flag is false and I found no advisory saying it is. The record does say an exploit has been disclosed, so do not read the lack of a KEV listing as safety.
Sources
Last reviewed: 19 October 2026.
