What’s Vulnerable › Vulnerabilities

CVE-2026-16448: D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-07-21
• Weakness: CWE-74

Description

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_check_rsync_rw of the file /cgi-bin/remote_backup.cgi. The manipulation of the argument ip results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Affected products

• D-Link DNR-202L: 20260205
• D-Link DNR-322L: 20260205
• D-Link DNR-326: 20260205
• D-Link DNS-1100-4: 20260205
• D-Link DNS-120: 20260205
• D-Link DNS-1200-05: 20260205
• D-Link DNS-1550-04: 20260205
• D-Link DNS-315L: 20260205
• D-Link DNS-320: 20260205
• D-Link DNS-320L: 20260205
• D-Link DNS-320LW: 20260205
• D-Link DNS-321: 20260205
• D-Link DNS-323: 20260205
• D-Link DNS-325: 20260205
• D-Link DNS-326: 20260205
• D-Link DNS-327L: 20260205
• D-Link DNS-340L: 20260205
• D-Link DNS-343: 20260205
• D-Link DNS-345: 20260205
• D-Link DNS-726-4: 20260205

References

• https://ucn9h68n9289.feishu.cn/docx/OfhNdwzvXoBlJBxDIW7clVmjnuh?from=from_copylink
• https://vuldb.com/cve/CVE-2026-16448
• https://vuldb.com/submit/858469
• https://vuldb.com/vuln/380827
• https://vuldb.com/vuln/380827/cti
• https://www.dlink.com/

Get alerted when CVE-2026-16448 or the next vulnerability affects your stack