CVE-2026-5311: D-Link Dnr-202l Firmware

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file /cgi-bin/file_center.cgi. Performing a manipulation of the argument cmd results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected products

• D-Link Dnr-202l Firmware: up to and including 2026-02-05
• D-Link Dnr-326 Firmware: up to and including 2026-02-05
• D-Link DNS-1100-4 Firmware: up to and including 2026-02-05
• D-Link DNS-1200-05 Firmware: up to and including 2026-02-05
• D-Link DNS-120 Firmware: up to and including 2026-02-05
• D-Link DNS-1550-04 Firmware: up to and including 2026-02-05
• D-Link DNS-315l Firmware: up to and including 2026-02-05
• D-Link DNS-320 Firmware: up to and including 2026-02-05
• D-Link DNS-320l Firmware: up to and including 2026-02-05
• D-Link DNS-320lw Firmware: up to and including 2026-02-05
• D-Link DNS-321 Firmware: up to and including 2026-02-05
• D-Link DNS-322l Firmware: up to and including 2026-02-05
• D-Link DNS-323 Firmware: up to and including 2026-02-05
• D-Link DNS-325 Firmware: up to and including 2026-02-05
• D-Link DNS-326 Firmware: up to and including 2026-02-05
• D-Link DNS-327l Firmware: up to and including 2026-02-05
• D-Link DNS-340l Firmware: up to and including 2026-02-05
• D-Link DNS-343 Firmware: up to and including 2026-02-05
• D-Link DNS-345 Firmware: up to and including 2026-02-05
• D-Link DNS-726-4 Firmware: up to and including 2026-02-05

Published 2026-04-01. Last modified 2026-06-17.