CVE-2026-4197: D-Link DNS-120 vulnerability

• critical 9.8 CVSS 3.1 (NVD)
• EPSS 21.7% chance of exploitation in the next 30 days, higher than 97% of CVEs (11 Nov 2026)
• Last changed at its sources 17 Jun 2026

Description

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function RSS_Get_Update_Status/RSS_Update/RSS_Channel_AutoDownlaod/RSS_Add/RSS_Channel_Item_Downlaod/RSS_History_Item_List/RSS_Item_List of the file /cgi-bin/download_mgr.cgi. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

Affected and fixed versions

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 10 Nov 2026.

Severity

References

• CVE-2026-4197 on NVD
• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_102/102.md Exploit, Third Party Advisory
• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_103/103.md Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.351109 Permissions Required, VDB Entry
• https://vuldb.com/?id.351109 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769864 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769865 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769866 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769867 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769868 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769869 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.769870 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.770363 Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.770364 Third Party Advisory, VDB Entry
• https://www.dlink.com/ Product