Is there a public PoC exploit available for CVE-2026-16329?

Yes, a public proof-of-concept exploit is available for CVE-2026-16329. Prioritise patching immediately. EPSS: 0.5%.

D-Link DNS-320 CVE-2026-16329

Q: What is the CVSS score of CVE-2026-16329?

CVE-2026-16329 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-46136 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-21 VulDB

GHSA-97fr-949f-2h6j

D-Link PHP File Upload Dns 320

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible, unauthenticated endpoint with no interaction required; impact kept Low/Low/Low consistent with the CVSS 4.0 VC:L/VI:L/VA:L reporter assessment pending independent RCE confirmation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 21, 2026 - 01:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 01:16 vuln.today

CVE Published

Jul 21, 2026 - 00:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.

Technical ContextAI

The D-Link DNS-320 is a home and SOHO network-attached storage device running a PHP-based web administration interface. The vulnerable component, /photo_center/php/uploadify.php, is part of the device's photo-center module and relies on the Uploadify jQuery plugin framework for handling multipart file uploads. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the server-side PHP script fails to validate or restrict the file type or extension submitted via the 'Malicious Handler' argument in the upload request, allowing content such as PHP scripts or other executable payloads to be written to the device filesystem. The CPE string cpe:2.3:a:d-link:dns-320 identifies the affected product as a D-Link DNS-320 application layer component. Because the device runs PHP to process web requests, an uploaded PHP file that lands in a web-accessible directory can subsequently be invoked by the attacker to execute arbitrary code.

RemediationAI

No vendor-released patch with an explicit fixed version number was identified at time of analysis; the references link to VulDB entries and the general D-Link website (https://www.dlink.com/) rather than a dedicated security advisory or firmware download. Administrators should check https://www.dlink.com/ for any firmware update for the DNS-320 addressing this upload flaw. The DNS-320 is an older SOHO device and may be end-of-life, in which case D-Link may not release a patch - if no patch is available, the most effective compensating control is to remove the device from internet-facing exposure by placing it behind a firewall with no port-forwarded access from the public internet, eliminating the network attack vector entirely. If web interface access is required remotely, restrict it to a VPN tunnel with authenticated access, which negates the PR:N exploit condition. Disabling the photo center module or removing uploadify.php from the web root would specifically address this endpoint but may break NAS photo-sharing functionality and should be tested for operational impact.