CVE-2026-16448

D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

Medium5.3EPSS 1.9%

Published: 21 Jul 2026
Updated: 21 Jul 2026
Reserved: 21 Jul 2026
Assigned by: VulDB

Description

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_check_rsync_rw of the file /cgi-bin/remote_backup.cgi. The manipulation of the argument ip results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Scores

CVSS scores of CVE-2026-16448, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	3.0	Medium6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
NVDNVD · Deferred	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.9% · top 20% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

D-Link · DNS-120
- affected 20260205
D-Link · DNR-202L
- affected 20260205
D-Link · DNS-315L
- affected 20260205
D-Link · DNS-320
- affected 20260205
D-Link · DNS-320L
- affected 20260205
D-Link · DNS-320LW
- affected 20260205
D-Link · DNS-321
- affected 20260205
D-Link · DNR-322L
- affected 20260205
D-Link · DNS-323
- affected 20260205
D-Link · DNS-325
- affected 20260205
D-Link · DNS-326
- affected 20260205
D-Link · DNS-327L
- affected 20260205
D-Link · DNR-326
- affected 20260205
D-Link · DNS-340L
- affected 20260205
D-Link · DNS-343
- affected 20260205
D-Link · DNS-345
- affected 20260205
D-Link · DNS-726-4
- affected 20260205
D-Link · DNS-1100-4
- affected 20260205
D-Link · DNS-1200-05
- affected 20260205
D-Link · DNS-1550-04
- affected 20260205

References (6)

VDB-380827 | D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection (opens in a new tab)vdb-entrytechnical-description
VDB-380827 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
CVE-2026-16448 | CVE Analysis and Report (opens in a new tab)third-party-advisory
Submit #858469 | D-Link (Shanghai)Limited Corp. D-Link DNS-120 affected at 20260205 CWE-77 (Command Injection) (opens in a new tab)third-party-advisory
https://ucn9h68n9289.feishu.cn/docx/OfhNdwzvXoBlJBxDIW7clVmjnuh?from=from_copylink (opens in a new tab)exploit
https://www.dlink.com/ (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-16448](https://trackcve.app/badge/CVE-2026-16448.svg)](https://trackcve.app/cve/CVE-2026-16448)

Record last updated 21 Jul 2026, 14:55 UTC.