CVE-2026-5211

CVE-2026-5211 describes a high-severity stack-based buffer overflow (CVSS 8.8) affecting numerous D-Link DNS and DNR series network-attached storage (NAS) devices, including firmware up to 20260205. The vulnerability resides in the UPnP_AV_Server_Path_Del function within /cgi-bin/app_mgr.cgi, allowing a remote attacker with low privileges to trigger the flaw by manipulating the f_dir argument. Exploitation requires low attack complexity and no user interaction, potentially leading to full compromise of confidentiality, integrity, and availability. While an exploit has been publicly published, there is currently no evidence of active exploitation in the wild, nor is it listed on the CISA KEV catalog or major exploit databases, though it has received minor community discussion.