CVE-2026-4211

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this issue is the function Local_Backup_Info of the file /cgi-bin/local_backup_mgr.cgi. This manipulation of the argument f_idx causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_160/160.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.351122Permissions Required, VDB Entry
• https://vuldb.com/?id.351122Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.770441Third Party Advisory, VDB Entry
• https://www.dlink.com/Product

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42096Sparx Pro Cloud Server is vulnerable to Broken Access Contro…8.8
• CVE-2026-42097Sparx Pro Cloud Server requires authentication based on requ…8.8
• CVE-2026-42098Sparx Enterprise Architect software has a security feature t…8.7
• CVE-2026-42099Sparx Pro Cloud Server is vulnerable to a Race Condition in …7.5
• CVE-2026-4210A security flaw has been discovered in D-Link DNS-120, DNR-2…9.8
• CVE-2026-42100Improper Handling of Syntactically Invalid Structure in Spar…7.5
• CVE-2026-4212A security vulnerability has been detected in D-Link DNS-120…9.8
• CVE-2026-42127The public dashboard query endpoint does not limit request b…7.5
• CVE-2026-42129A user with Viewer permissions can use a path traversal in t…7.7
• CVE-2026-4213A vulnerability was detected in D-Link DNS-120, DNR-202L, DN…9.8
• CVE-2026-42137Kirby is an open-source content management system. Prior to …6.5
• CVE-2026-42138Dify is an open-source LLM app development platform. Prior t…6.1