Is there a public PoC exploit available for CVE-2026-16327?

Yes, a public proof-of-concept exploit is available for CVE-2026-16327. Prioritise patching immediately. EPSS: 0.7%.

D-Link DNS-320 CVE-2026-16327

Q: What is the CVSS score of CVE-2026-16327?

CVE-2026-16327 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-46135 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 VulDB

GHSA-6ccf-xr2j-ch59

D-Link PHP File Upload Dns 320

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network upload of PHP webshell yields full RCE, so S:C and C/I/A:H; PR:N and UI:N confirmed by CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 00:28 vuln.today

CVSS changed

Jul 21, 2026 - 00:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 20, 2026 - 23:45 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /web/web_file/upload.php endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.

Technical ContextAI

CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the PHP script /web/web_file/upload.php accepts attacker-controlled file submissions via the File argument without enforcing restrictions on file extension, MIME type, or content. On a PHP-capable web server - as is typical in embedded NAS management interfaces - an attacker-uploaded .php file placed in a web-accessible directory becomes executable by the server, converting a file-write primitive into remote code execution. The CPE cpe:2.3:a:d-link:dns-320:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all DNS-320 firmware builds may be in scope, though version 1.0.2 is the explicitly confirmed target. The DNS-320 runs an embedded Linux platform with a PHP-driven web management interface, common across D-Link's consumer NAS lineup of that era.

RemediationAI

No vendor-released patch has been identified at time of analysis; the DNS-320 is an EOL device and D-Link has not published a security advisory. The primary fix is device replacement with a supported NAS solution. For devices that cannot be immediately replaced, immediately remove the web management interface from internet exposure by blocking TCP ports 80 and 443 at the network perimeter - this eliminates the remote attack vector entirely but does not address local network exposure. If the device must be accessible, restrict management interface access to a specific trusted administrator IP range via firewall ACLs; this trades open access for a reduced but non-zero attack surface. Disable the file upload feature or the web server component if the device firmware allows it, noting this will impair NAS management functionality. The VulDB disclosure is at https://vuldb.com/vuln/380693, and the referenced exploit document is at the Feishu link in the CVE references. D-Link's site at https://www.dlink.com/ should be monitored for any late-stage advisory.