CVE-2026-5213: D-Link DNR-202L Buffer Overflow Vulnerability

CVE-2026-5213 Overview

CVE-2026-5213 is a stack-based buffer overflow vulnerability affecting a large set of D-Link network-attached storage (NAS) devices through firmware version 20260205. The flaw resides in the cgi_adduser_to_session function within /cgi-bin/account_mgr.cgi. Attackers can trigger memory corruption by manipulating the read_list argument over the network. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed devices. D-Link has classified many of the affected models as end-of-life, meaning no official patches are expected for legacy hardware.

Critical Impact
Remote attackers with low privileges can corrupt stack memory through the account_mgr.cgi endpoint, leading to denial of service or potential remote code execution on affected D-Link NAS devices.

Affected Products

D-Link DNS-120, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L (firmware up to 20260205)
D-Link DNR-202L, DNR-322L, DNR-326 (firmware up to 20260205)
D-Link DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 (firmware up to 20260205)

Discovery Timeline

2026-03-31 - CVE-2026-5213 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-5213

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] combined with an out-of-bounds write [CWE-787] and improper restriction of operations within memory bounds [CWE-119]. The defect lives in the cgi_adduser_to_session function exposed through the /cgi-bin/account_mgr.cgi endpoint. When the CGI handler processes the read_list parameter, it copies attacker-controlled input into a fixed-size stack buffer without validating the input length. Sending an oversized read_list value overwrites adjacent stack memory, including saved return addresses and frame pointers.

The attack is reachable over the network and requires only low-level authentication on the device. Successful exploitation can crash the CGI process, corrupt control flow, or, depending on memory protections present in the firmware, allow arbitrary code execution under the privileges of the web service. Because most affected devices run the CGI binary with elevated privileges and lack modern exploit mitigations such as stack canaries or ASLR, the path from overflow to code execution is short.

Root Cause

The root cause is missing bounds checking on the read_list HTTP parameter before it is copied into a fixed-length stack buffer inside cgi_adduser_to_session. The CGI binary trusts the caller-supplied length and uses unsafe string-handling primitives that do not enforce destination buffer size.

Attack Vector

An attacker who can reach the device's web management interface, either directly on the LAN or through internet-exposed NAS appliances, sends a crafted HTTP request to /cgi-bin/account_mgr.cgi with an overlong read_list argument. The exploitation technique and proof-of-concept are documented in the public GitHub Vulnerability Document and the VulDB entry #354350.

No verified exploit code is reproduced here. Refer to the linked advisories for the exact request format and offset details.

Detection Methods for CVE-2026-5213

Indicators of Compromise

HTTP requests to /cgi-bin/account_mgr.cgi containing the cgi_adduser_to_session action with abnormally long read_list parameter values.
Repeated 5xx responses, web service crashes, or CGI process restarts on the NAS appliance shortly after inbound requests to account_mgr.cgi.
Unexpected outbound connections originating from the NAS to attacker-controlled infrastructure following web requests to the management interface.

Detection Strategies

Inspect web server and reverse-proxy logs for POST or GET requests to /cgi-bin/account_mgr.cgi where read_list exceeds typical lengths (for example, more than a few hundred bytes).
Deploy network IDS signatures that match requests to account_mgr.cgi with the cgi_adduser_to_session action and oversized parameters.
Monitor for new processes, shell activity, or configuration changes on NAS devices that lack legitimate administrative justification.

Monitoring Recommendations

Forward syslog and web access logs from D-Link NAS appliances to a centralized log platform for retention and correlation.
Alert on inbound traffic to NAS management interfaces from non-administrative source networks, especially from the public internet.
Baseline normal account_mgr.cgi usage so anomalous parameter sizes or request rates trigger investigation.

How to Mitigate CVE-2026-5213

Immediate Actions Required

Remove affected D-Link NAS devices from direct internet exposure and restrict the management interface to trusted administrative networks only.
Disable remote management features such as UPnP, port forwarding, and cloud access for the listed DNS and DNR models until mitigations are in place.
Rotate administrative credentials on all affected NAS devices, since exploitation requires low-privileged authenticated access.
Plan migration away from end-of-life D-Link NAS hardware to actively supported storage platforms.

Patch Information

No vendor security patch is referenced in the CVE record. Many of the listed models are legacy and end-of-life D-Link products, for which the vendor typically does not issue firmware updates. Consult the D-Link Official Website and the VulDB entry #354350 for any future advisories. Replace unsupported devices where feasible.

Workarounds

Place affected NAS devices behind a firewall and limit access to /cgi-bin/account_mgr.cgi using ACLs that allow only specific management workstations.
Use a reverse proxy or web application firewall to drop HTTP requests targeting account_mgr.cgi with read_list parameter values exceeding a strict length threshold.
Segment NAS appliances into an isolated VLAN with no outbound internet access to limit post-exploitation impact.
Decommission devices that are no longer receiving firmware updates from D-Link.

bash

# Example firewall rule limiting NAS management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP