# CVE-2026-5213: D-Link NAS and NVR stack buffer overflow in account_mgr.cgi

Source: https://junglewise.ai/threats/cve-2026-5213-d-link-nas-and-nvr-stack-buffer-overflow-in-account-mgr-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5213 · Severity: high · CVSS 8.8 · Published 2026-03-31

A security vulnerability exists in several D-Link Network Attached Storage (NAS) and Video Recorder (NVR) devices. These devices are used to store and manage data or security camera footage on a network. An attacker can exploit this flaw to crash the device or potentially take full control of it, leading to data loss, service outages, or unauthorized access to stored files.

## Quick answers

**Is CVE-2026-5213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5213 being exploited in the wild.

**How severe is CVE-2026-5213?** High severity, with a CVSS score of 8.8, published 31 March 2026.

**Which products and versions are affected?** D-Link DNS-120 up to 20260205; D-Link DNR-202L up to 20260205; D-Link DNS-315L up to 20260205; D-Link DNS-320 up to 20260205; and 5 more.

**Is there a fix for CVE-2026-5213?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5213 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5213?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the cgi_adduser_to_session function within the /cgi-bin/account_mgr.cgi component of multiple D-Link NAS and NVR models. The vulnerability is triggered by providing excessively long strings to the read_list, write_list, or decline_list parameters during a POST request. Because the application fails to validate the length of these inputs before copying them to local stack variables, an attacker can overwrite the return address to redirect execution flow. While the attack requires network reachability and low-level authentication (PR:L), successful exploitation can lead to complete system compromise or persistent denial of service. A public exploit (PoC) has been disclosed.

## Affected products

- D-Link DNS-120 up to 20260205
- D-Link DNR-202L up to 20260205
- D-Link DNS-315L up to 20260205
- D-Link DNS-320 up to 20260205
- D-Link DNS-320L up to 20260205
- D-Link DNS-320LW up to 20260205
- D-Link DNS-321 up to 20260205
- D-Link DNR-322L up to 20260205
- D-Link,versions: DNS-323

## Timeline

- 2026-03-31: advisory: Initial disclosure of CVE-2026-5213

## References

- [https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_168/168.md](https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_168/168.md)
- [https://vuldb.com/submit/780437](https://vuldb.com/submit/780437)
- [https://vuldb.com/vuln/354350](https://vuldb.com/vuln/354350)
- [https://vuldb.com/vuln/354350/cti](https://vuldb.com/vuln/354350/cti)
- [https://www.dlink.com/](https://www.dlink.com/)