CVE-2026-4196
published 2026-03-16CVE-2026-4196: A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.11%
90.1th percentile
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the function cgi_recovery/cgi_backup_now/cgi_set_schedule/cgi_set_rsync_server of the file /cgi-bin/remote_backup.cgi. The manipulation leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dnr-202l | — | — |
| d-link | dnr-322l | — | — |
| d-link | dnr-326 | — | — |
| d-link | dns-1100-4 | — | — |
| d-link | dns-120 | — | — |
| d-link | dns-1200-05 | — | — |
| d-link | dns-1550-04 | — | — |
| d-link | dns-315l | — | — |
| d-link | dns-320 | — | — |
| d-link | dns-320l | — | — |
| d-link | dns-320lw | — | — |
| d-link | dns-321 | — | — |
| d-link | dns-323 | — | — |
| d-link | dns-325 | — | — |
| d-link | dns-326 | — | — |
| d-link | dns-327l | — | — |
| d-link | dns-340l | — | — |
| d-link | dns-343 | — | — |
| d-link | dns-345 | — | — |
| d-link | dns-726-4 | — | — |
| dlink | dnr-202l_firmware | <= 2026-02-05 | — |
| dlink | dnr-326_firmware | <= 2026-02-05 | — |
| dlink | dns-1100-4_firmware | <= 2026-02-05 | — |
| dlink | dns-1200-05_firmware | <= 2026-02-05 | — |
| dlink | dns-120_firmware | <= 2026-02-05 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers [epel-all]
bugzilla·2026-08-25·CVSS 6.5
CVE-2026-78322 [MEDIUM] CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers [epel-all]
CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A stack-based buffer overflow exists in file-roller's parse_progress_line() functions in the 7z and RAR archive backends (src/fr-command-7z.c and src/fr-command-rar.c). When processing output from the 7z or rar subprocess, file paths from archive entries are copied with strcpy() into fixed-size stack buffers (4196 and 4096 bytes) without length validation. An archive containing a file entry with a path longer than these buffers causes a stack buffer
Bugzilla
CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers
bugzilla·2026-08-24·CVSS 6.5
CVE-2026-78322 [MEDIUM] CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers
CVE-2026-78322 file-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and RAR handlers
A stack-based buffer overflow exists in file-roller's parse_progress_line() functions in the 7z and RAR archive backends (src/fr-command-7z.c and src/fr-command-rar.c). When processing output from the 7z or rar subprocess, file paths from archive entries are copied with strcpy() into fixed-size stack buffers (4196 and 4096 bytes) without length validation. An archive containing a file entry with a path longer than these buffers causes a stack buffer overflow when the user opens or extracts the archive in file-roller, resulting in denial of service (process termination). Practical code execution is considered difficult on hardened builds with stack canaries, PIE, and ASLR.
Reporte
https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_98/98.mdhttps://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_99/99.mdhttps://vuldb.com/?ctiid.351108https://vuldb.com/?id.351108https://vuldb.com/?submit.769855https://vuldb.com/?submit.769856https://vuldb.com/?submit.769857https://vuldb.com/?submit.769858https://www.dlink.com/
2026-03-16
Published