| शीर्षक | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/340L/343/345/726-4/1100-4/1200-05/1550-04 up to 20260205 Authentication Bypass Issues |
|---|
| विवरण | We identified an authentication bypass vulnerability in a recently released firmware of a D-Link NAS device. This vulnerability allows remote attackers to bypass authentication checks and gain unauthorized access via specially crafted requests.By abusing the cgi_set_wto interface, an attacker can modify the default admin account configuration to achieve persistent privileged access. After establishing this unauthorized persistence, the attacker can access arbitrary management interfaces, and further chain this vulnerability with other authenticated flaws, such as command injection or buffer overflow vulnerabilities, to ultimately gain full control of the device. |
|---|
| स्रोत | ⚠️ https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_96/96.md |
|---|
| उपयोगकर्ता | pjq123 (UID 86618) |
|---|
| सबमिशन | 02/03/2026 09:52 AM (7 महीनों पहले) |
|---|
| संयम | 15/03/2026 09:22 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351106 [D-Link DNS-1550-04 तक 20260205 /cgi-bin/system_mgr.cgi cgi_set_wto अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|