CVE-2026-5311 PUBLISHED

D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control

Assigner: VulDB
Reserved: 01.04.2026 Published: 01.04.2026 Updated: 02.04.2026

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 6.9

Product Status

Vendor D-Link
Product DNS-120
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNR-202L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-315L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-320
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-320L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-320LW
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-321
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNR-322L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-323
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-325
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-326
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-327L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNR-326
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-340L
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-343
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-345
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-726-4
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-1100-4
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-1200-05
Versions
  • Version 20260205 is affected
Vendor D-Link
Product DNS-1550-04
Versions
  • Version 20260205 is affected

Credits

  • Ziyue Xie (VulDB User) reporter

References

Problem Types

  • Improper Access Controls CWE
  • Incorrect Privilege Assignment CWE