CVE-2026-4210: D-Link DNR-202L Firmware RCE Vulnerability

CVE-2026-4210 Overview

A command injection vulnerability has been discovered in multiple D-Link Network Attached Storage (NAS) devices affecting the cgi_tm_set_share function within the /cgi-bin/time_machine.cgi file. This vulnerability allows remote attackers to execute arbitrary commands on the affected devices by manipulating the Name argument. The exploit has been publicly released, increasing the risk of widespread exploitation against vulnerable D-Link NAS devices.

Critical Impact

Remote attackers with low-level privileges can exploit this command injection vulnerability to execute arbitrary system commands on affected D-Link NAS devices, potentially leading to complete device compromise, data theft, or use of the device in botnet operations.

Affected Products

• D-Link DNS-120, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321
• D-Link DNS-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L
• D-Link DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04
• D-Link DNR-202L, DNR-322L, DNR-326
• Firmware versions up to 20260205

Discovery Timeline

• 2026-03-16 - CVE-2026-4210 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-4210

Vulnerability Analysis

This vulnerability exists in the Time Machine functionality of D-Link NAS devices, specifically within the cgi_tm_set_share function. The vulnerable endpoint /cgi-bin/time_machine.cgi fails to properly sanitize the Name parameter before passing it to system-level commands. This allows attackers to inject arbitrary shell commands that execute with the privileges of the web server process, typically running as root on these embedded devices.

The attack can be launched remotely over the network, requiring only low-level authentication. Given that many D-Link NAS devices are deployed in home and small business environments with direct internet exposure or inadequate network segmentation, this vulnerability presents a significant risk. NAS devices are particularly attractive targets as they often contain sensitive data and can serve as pivot points for lateral movement within networks.

Root Cause

The root cause is inadequate input validation and sanitization in the cgi_tm_set_share function (CWE-77: Command Injection, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Name argument is directly incorporated into shell commands without proper escaping or validation, allowing metacharacters and command sequences to be interpreted by the underlying shell.

Attack Vector

The attack is conducted remotely over the network. An authenticated attacker with low privileges can send a crafted HTTP request to the /cgi-bin/time_machine.cgi endpoint with a malicious payload in the Name parameter. The injected commands are then executed by the system shell, potentially giving the attacker complete control over the NAS device.

The vulnerability can be exploited by injecting shell metacharacters such as semicolons (;), pipes (|), or command substitution sequences ($(...) or backticks) into the Name parameter. These special characters allow the attacker to terminate the legitimate command and append arbitrary commands that will be executed with elevated privileges.

For detailed technical analysis and proof-of-concept information, refer to the GitHub Vulnerability Documentation.

Detection Methods for CVE-2026-4210

Indicators of Compromise

• Unusual HTTP requests to /cgi-bin/time_machine.cgi containing shell metacharacters or command sequences in parameters
• Unexpected processes spawned by the web server process on the NAS device
• Suspicious outbound network connections from the NAS device to unknown external hosts
• Modified system files or unauthorized user accounts on the NAS device

Detection Strategies

• Implement web application firewall (WAF) rules to detect command injection patterns in HTTP requests targeting /cgi-bin/time_machine.cgi
• Monitor network traffic for anomalous requests to D-Link NAS web interfaces, particularly those containing shell metacharacters
• Deploy intrusion detection system (IDS) signatures for known command injection attack patterns targeting D-Link devices
• Review web server logs on NAS devices for requests containing suspicious characters in the Name parameter

Monitoring Recommendations

• Enable verbose logging on D-Link NAS devices and forward logs to a centralized SIEM for analysis
• Set up alerts for any access to the Time Machine CGI endpoint from untrusted network segments
• Monitor for lateral movement attempts originating from NAS device IP addresses
• Implement network segmentation monitoring to detect NAS devices communicating with unexpected internal or external hosts

How to Mitigate CVE-2026-4210

Immediate Actions Required

• Isolate affected D-Link NAS devices from direct internet exposure immediately
• Place vulnerable devices behind a properly configured firewall that restricts access to the web management interface
• Disable the Time Machine feature if not required for business operations
• Audit NAS devices for signs of compromise before implementing other mitigations

Patch Information

At the time of publication, no official patch has been released by D-Link for this vulnerability. Many of the affected D-Link NAS models are legacy products that have reached end-of-life status and may not receive security updates. Organizations should check the D-Link Official Website for the latest security advisories and firmware updates. For additional vulnerability details, consult VulDB #351121.

Workarounds

• Implement strict network access controls to limit connectivity to the NAS web interface to trusted management hosts only
• Use a VPN for remote access to NAS devices rather than exposing the management interface directly
• Consider replacing end-of-life D-Link NAS devices with actively supported alternatives that receive regular security updates
• Deploy a reverse proxy with input validation in front of the NAS web interface to filter malicious requests

# Example firewall rules to restrict access to NAS management interface
# Replace 192.168.1.100 with your NAS IP and 192.168.1.0/24 with trusted network

# Allow management access only from trusted network
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT

# Block all other access to NAS web interface
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 443 -j DROP