CVE-2026-5215: D-Link DNR-202L Auth Bypass Vulnerability

CVE-2026-5215 Overview

CVE-2026-5215 is an improper access control vulnerability affecting a broad range of D-Link network-attached storage (NAS) devices. The flaw resides in the cgi_get_ipv6 function within /cgi-bin/network_mgr.cgi. An attacker on the adjacent network can manipulate the affected element to bypass access restrictions and retrieve IPv6 configuration data without proper authorization. The issue is tracked under [CWE-266: Incorrect Privilege Assignment]. Public exploit information has been disclosed, increasing the likelihood of opportunistic abuse against exposed devices. The affected D-Link product family is end-of-life for many models, meaning vendor patches may not be released.

Critical Impact
An adjacent network attacker can invoke cgi_get_ipv6 without proper authorization and obtain network configuration data from affected D-Link NAS devices.

Affected Products

D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321 firmware up to 20260205
D-Link DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L firmware up to 20260205
D-Link DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 firmware up to 20260205

Discovery Timeline

2026-03-31 - CVE-2026-5215 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5215

Vulnerability Analysis

The vulnerability lives in the cgi_get_ipv6 handler exposed through /cgi-bin/network_mgr.cgi on D-Link NAS firmware images up to build 20260205. The CGI endpoint is reachable from the local network segment over the device's HTTP management interface. The handler fails to enforce proper authorization checks before returning IPv6 configuration information.

An attacker positioned on the adjacent network can issue a crafted HTTP request to the endpoint and receive sensitive network details. The disclosed information can support reconnaissance of internal addressing, prefix delegation, and routing configuration. Exploitation requires no authentication and no user interaction.

Because the same network_mgr.cgi binary is shared across the listed DNS and DNR product families, a single exploitation technique applies to all affected devices. Many of these models have reached end-of-support, which limits the availability of official fixes.

Root Cause

The root cause is improper access control [CWE-266] within the cgi_get_ipv6 function. The handler does not validate whether the requesting session holds the privilege required to read IPv6 network configuration. Authorization logic is either missing or executed after the sensitive data is returned.

Attack Vector

The attack vector is adjacent network. An attacker on the same broadcast or routed segment as the NAS sends an HTTP request to /cgi-bin/network_mgr.cgi invoking the cgi_get_ipv6 action. The device responds with IPv6 configuration data despite the absence of valid administrative credentials. Public proof-of-concept material is referenced in the GitHub Vulnerability Document.

No verified exploit code is included here. Refer to the linked advisory for request structure details.

Detection Methods for CVE-2026-5215

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to /cgi-bin/network_mgr.cgi referencing the cgi_get_ipv6 action from non-administrative hosts.
Web server access logs on the NAS showing repeated calls to network_mgr.cgi from a single LAN-resident source within a short time window.
Unexpected outbound reconnaissance from hosts that previously queried the NAS management interface.

Detection Strategies

Monitor LAN segments hosting D-Link DNS and DNR appliances for HTTP traffic patterns targeting /cgi-bin/network_mgr.cgi.
Correlate management interface access with authenticated administrator session activity to surface unauthorized requests.
Apply network IDS signatures that flag requests to cgi_get_ipv6 originating from non-administrative subnets.

Monitoring Recommendations

Forward NAS web server and authentication logs to a centralized log platform for retention and search.
Alert on any HTTP 200 response to network_mgr.cgi that is not preceded by a successful login event.
Track ARP and DHCP changes on segments containing affected NAS devices to identify rogue adjacent hosts.

How to Mitigate CVE-2026-5215

Immediate Actions Required

Restrict access to the NAS management interface using VLAN segmentation or host firewall rules so only administrator workstations can reach /cgi-bin/.
Disable remote management features and ensure the device is not reachable from untrusted wireless networks.
Inventory all D-Link DNS and DNR appliances and confirm firmware build relative to 20260205.

Patch Information

No vendor advisory or fixed firmware build is listed in the references for CVE-2026-5215. Many of the affected models are end-of-life, and D-Link may not release a corrective firmware. Organizations should consult the D-Link Official Website for product status and plan device replacement where no patch is forthcoming.

Workarounds

Place affected NAS devices on an isolated management VLAN with explicit allow-list ACLs for administrative hosts.
Block inbound TCP/80 and TCP/443 to the NAS from general user subnets at the distribution switch or firewall.
Replace end-of-life D-Link NAS hardware with currently supported storage platforms that receive security updates.

bash

# Example: restrict NAS management to a single admin host (iptables on an upstream Linux gateway)
iptables -A FORWARD -p tcp -d <NAS_IP> --dport 80 -s <ADMIN_IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <NAS_IP> --dport 443 -s <ADMIN_IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <NAS_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <NAS_IP> --dport 443 -j DROP