CVE-2026-4205 is a command injection flaw in the /cgi-bin/app_mgr.cgi handler of D-Link DNS network storage firmware up to 20260205, scored CVSS 6.3 (medium). I could not confirm a vendor fix. Check D-Link support for your model, and keep the web management interface off the internet until you know.
What's affected
The NVD record lists these D-Link models, all "up to 20260205": DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04. The vulnerable code is in /cgi-bin/app_mgr.cgi, in cgi_refresh_db, FTP_Server_BlockIP_Add and FTP_Server_BlockIP_Del.
The record gives no fixed firmware version, and the references do not include a D-Link advisory that names one. The reporter's write-up says testing used DNS-320 firmware 2.06b01, which it calls the latest version at the time. Treat the other listed models as affected until D-Link says otherwise.
How to check if you're exposed
- Find the model name on the device label or in the web administration page, and compare it with the list above.
- Read the firmware version in the administration page. The record says everything up to 20260205 is affected, so a recent looking version is not proof of safety.
- Look for a firmware download or security notice for your model on the D-Link support site. Since I could not read one, the advisory steps are the authority here.
- From a network outside your own, scan your public address for the management ports. Only do this for addresses you own.
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
If a management port answers from the internet, treat the device as exposed.
What to do now
- List every D-Link NAS on your networks, including ones in branch offices and labs.
- Remove any port forward or cloud relay that publishes the web interface to the internet.
- Limit management access to one admin network or a small set of addresses.
- Apply a firmware update if D-Link has published one for your model.
- If no update exists, plan to replace the device, and copy its data somewhere safe first.
- Remove unused accounts and set strong, unique passwords, because the attack needs a login.
Why it matters
The record classes this as CWE-74 and CWE-77: a request value reaches an operating system command without its special characters being neutralized. The write-up names f_dir and f_function as the value passed straight from the request into the affected code. Two of the functions manage the FTP server block list, and the first refreshes a media database.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That means it is reachable over the network, needs a low privileged login, and needs no user action. The record says the exploit has been disclosed to the public. The KEV flag is false, and I found no report of exploitation in the wild.
Network storage often holds backups and shared files, so a flaw in its web interface deserves attention even at medium scores. For a wider view of old or unpatched components in your estate, run the free in-browser dependency scan on your own software, and browse the Gold directory for related records.
Quick check
Is CVE-2026-4205 exploited in the wild?
The record's KEV flag is false and I found no advisory saying it is. The record does say an exploit has been disclosed, so do not read the lack of a KEV listing as safety.
Sources
Last reviewed: 19 October 2026.
