CVE-2026-5211: Stack Overflow in D-Link DNS Routers

The vulnerability lies within the UPnPAVServerPathDel function of the /cgi-bin/appmgr.cgi file. An attacker can exploit this by manipulating the 'fdir' argument, causing a stack-based buffer overflow. This overflow can overwrite critical memory regions, potentially allowing the attacker to gain control of the router. Given the router's role in network connectivity and often containing sensitive configuration data, a successful exploit could lead to complete system compromise, data theft, and unauthorized access to the internal network. The published exploit significantly increases the risk of immediate exploitation.

1. Reserved2026-03-31
2. Published2026-03-31
3. Modified2026-04-01
4. EPSS updated2026-04-08

The primary mitigation is to upgrade the affected D-Link DNS routers to a firmware version that includes the security patch. D-Link is expected to release a patch soon. Until the patch is available, consider implementing temporary workarounds such as restricting access to the /cgi-bin/app_mgr.cgi endpoint using a firewall or access control list (ACL). Web application firewalls (WAFs) configured to detect and block buffer overflow attempts targeting UPnP functionality can also provide some protection. Monitor router logs for unusual activity or error messages related to the UPnP service.