Loading story…
D-Link NAS and recorder products were found to contain multiple remote stack-based buffer overflow vulnerabilities affecting /cgi-bin/app_mgr.cgi, /cgi-bin/webdav_mgr.cgi, and /cgi-bin/account_mgr.cgi. The issues were assigned CVE-2026-5211, CVE-2026-5212, and CVE-2026-5213 and impact a broad set of devices, including DNS-120, DNS-320 series, DNS-340L, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04.
The flaws are triggered by crafted input to specific parameters: f_dir in the UPnP_AV_Server_Path_Del function, f_file in the Webdav_Upload_File function, and read_list in the cgi_adduser_to_session function. Because the vulnerabilities can be exploited remotely and public exploit details have been disclosed, exposed devices face an elevated risk of compromise and potential attacker weaponization in real-world attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Three stack-based buffer overflow vulnerabilities affecting multiple D-Link NAS and recorder products were publicly disclosed: CVE-2026-5211 in /cgi-bin/app_mgr.cgi, CVE-2026-5212 in /cgi-bin/webdav_mgr.cgi, and CVE-2026-5213 in /cgi-bin/account_mgr.cgi. The flaws are remotely exploitable and the disclosures note public exploit details or exploit availability, raising the risk to exposed devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-5983** and **CVE-2026-5984**, were disclosed in the unsupported **D-Link DIR-605L** router running firmware `2.13B01`. Both flaws are remote **buffer overflows** tied to POST request handlers exposed under `/goform/`, with the `curTime` argument identified as the attack vector. **CVE-2026-5983** affects the `formSetDDNS` function in `/goform/formSetDDNS`, while **CVE-2026-5984** affects the `formSetLog` function in `/goform/formSetLog`. The vulnerabilities are classified under **CWE-119** and **CWE-120** and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a **public exploit** is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Jun 29, 2026
Two router vulnerabilities have been disclosed that expose **D-Link DIR-513** and **Tenda A18 Pro** devices to remotely triggered stack-based buffer overflows. **CVE-2026-4486** affects D-Link DIR-513 version `1.10` in the web service function `formEasySetPassword` at the `/goform/formEasySetPassword` endpoint, where a crafted `curTime` argument can trigger memory corruption. The issue is classified under `CWE-119` and `CWE-121`, and the affected D-Link product is no longer supported by the vendor. A separate flaw, **CVE-2026-4491**, impacts **Tenda A18 Pro** firmware `02.03.02.28` in the `fromSetIpMacBind` function exposed through `/goform/SetIpMacBind`. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as **publicly exploitable**, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Jun 29, 2026
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026