5.3

CVE-2026-5215: d-link dnr-202l Incorrect Privilege Assignment

CVSS: 5.3v4.0MediumAnalyzed
Published 31-03-2026Last modified 01-04-2026
Open JSON

Vulnerability summary

CVE-2026-5215 is a medium (CVSS 5.3) Incorrect Privilege Assignment vulnerability in d-link dnr-202l. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v4.0 (CVE.org)
EPSS score
1.42%
0%100%
Low · +0.57 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 31-03-2026
    PublishedVulnerability first disclosed.
  2. 01-04-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function cgi_get_ipv6 of the file /cgi-bin/network_mgr.cgi. Such manipulation leads to improper access controls. The exploit is publicly available and might be used.

CVSS metrics

7 scores · 2 sources · 4 versions

EPSS trend

Probability

1.42%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

+0.57 pp

From 0.84% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    My Vuln

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

D-link20 products
Dlink20 products

2 vendors · 40 products

References

5 links