D-Link DNS-320 CVE-2026-16327

The device's web management interface - specifically the /web/web_file/upload.php endpoint - must be reachable by the attacker over HTTP/HTTPS. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, user interaction, or special preconditions are required beyond network access to the management port. Exploitation is limited by: (1) network exposure - devices behind NAT or with management ports firewalled from untrusted networks are not directly reachable; (2) firmware version - version 1.0.2 is confirmed, but the CPE wildcard suggests broader applicability that has not been vendor-confirmed; (3) web server configuration - successful webshell execution requires the server to store uploaded files in a path served by the PHP-capable web server, which is the default behavior for this class of embedded NAS device. No special features, non-default settings, or privileged accounts are required to trigger the upload vulnerability itself.

Real-world risk is materially higher than the provided CVSS 4.0 score of 5.5 suggests. The impact metrics VC:L/VI:L/VA:L appear to reflect only the direct file-write impact, not the downstream consequence of PHP webshell execution, which typically yields full confidentiality, integrity, and availability compromise of the device. The attack vector (AV:N/AC:L/AT:N/PR:N/UI:N) is as permissive as possible - unauthenticated, low-complexity, remote exploitation against default configurations. The E:P modifier and the referenced exploit document confirm public exploit availability, which actively lowers the technical bar for opportunistic exploitation. No CISA KEV listing means active mass exploitation is not yet confirmed, but the combination of PR:N exploitation, a public exploit, and an EOL device with no patch path makes this a high-priority remediation item for any organization with DNS-320 devices reachable from untrusted networks. CVSS 4.0 score likely understates impact - defenders should treat realistic exploitation as yielding full device compromise.

An attacker scans the internet for D-Link DNS-320 devices with web management ports exposed, then sends a crafted unauthenticated HTTP POST request to /web/web_file/upload.php with a PHP webshell embedded as the uploaded file value of the File parameter. If the server stores the upload in a web-accessible path and the web server executes PHP, the attacker requests the uploaded file's URL and receives a command execution interface with web server privileges. A public exploit demonstrating this technique has been disclosed via the referenced Feishu document.