CVE-2026-4213

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_162/162.mdExploit, Third Party Advisory
• https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_163/163.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.351124Permissions Required, VDB Entry
• https://vuldb.com/?id.351124Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.770443Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.770444Third Party Advisory, VDB Entry
• https://www.dlink.com/Product

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4210A security flaw has been discovered in D-Link DNS-120, DNR-2…9.8
• CVE-2026-42100Improper Handling of Syntactically Invalid Structure in Spar…7.5
• CVE-2026-4211A weakness has been identified in D-Link DNS-120, DNR-202L, …9.8
• CVE-2026-4212A security vulnerability has been detected in D-Link DNS-120…9.8
• CVE-2026-42127The public dashboard query endpoint does not limit request b…7.5
• CVE-2026-42129A user with Viewer permissions can use a path traversal in t…7.7
• CVE-2026-42137Kirby is an open-source content management system. Prior to …6.5
• CVE-2026-42138Dify is an open-source LLM app development platform. Prior t…6.1
• CVE-2026-4214A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L,…9.8
• CVE-2026-42140PlantUML Macro is a macro for rendering UML diagrams from si…4.4
• CVE-2026-42141Xibo is an open source digital signage platform with a web c…7.7
• CVE-2026-42142TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1