CVE-2026-5311: D-Link DNS-120, заобикаляне на вход и права

Описание

Оригинално описание

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Засегнати продукти

• D-Link DNS-120: 20260205
• D-Link DNR-202L: 20260205
• D-Link DNS-315L: 20260205
• D-Link DNS-320: 20260205
• D-Link DNS-320L: 20260205
• D-Link DNS-320LW: 20260205
• D-Link DNS-321: 20260205
• D-Link DNR-322L: 20260205
• D-Link DNS-323: 20260205
• D-Link DNS-325: 20260205
• D-Link DNS-326: 20260205
• D-Link DNS-327L: 20260205
• D-Link DNR-326: 20260205
• D-Link DNS-340L: 20260205
• D-Link DNS-343: 20260205
• D-Link DNS-345: 20260205
• D-Link DNS-726-4: 20260205
• D-Link DNS-1100-4: 20260205
• D-Link DNS-1200-05: 20260205
• D-Link DNS-1550-04: 20260205

Вид слабост

• CWE-284 Неправилен контрол на достъпа
• CWE-266 Неправилно задаване на привилегии

История

Други уязвимости в D-Link DNS-120

• 9.9CVE-2026-85223
• 9.4CVE-2026-85222
• 9.9CVE-2026-82692
• 9.4CVE-2026-82691
• 9.4CVE-2026-82690

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-5311
• https://nvd.nist.gov/vuln/detail/CVE-2026-5311
• https://vuldb.com/vuln/354640
• https://vuldb.com/vuln/354640/cti
• https://vuldb.com/submit/780441
• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md
• https://www.dlink.com/