9.8

CVE-2026-4194: d-link dnr-202l Incorrect Privilege Assignment

CVSS: 9.8v3.1CriticalAnalyzed
Published 15-03-2026Last modified 16-03-2026
Open JSON

Vulnerability summary

CVE-2026-4194 is a critical (CVSS 9.8) Incorrect Privilege Assignment vulnerability in d-link dnr-202l. EPSS estimates a 3.12% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
3.12%
0%100%
Low · +1.88 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 15-03-2026
    PublishedVulnerability first disclosed.
  2. 16-03-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_set_wto of the file /cgi-bin/system_mgr.cgi. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVSS metrics

7 scores · 2 sources · 4 versions

EPSS trend

Probability

3.12%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

+1.88 pp

From 1.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.12%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    My Vuln

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

D-link20 products
Dlink20 products

2 vendors · 40 products

References

5 links