D-Link DNS-320 CVE-2026-16329

No authentication is required - the CVSS 4.0 vector explicitly specifies PR:N and UI:N, meaning the /photo_center/php/uploadify.php endpoint is accessible to unauthenticated remote attackers without any user interaction. The primary condition enabling exploitation is network reachability to the device's web interface (port 80 or 443), which is common for home or SOHO NAS devices that have been port-forwarded or directly exposed to the internet. The specific limiting factor is that the DNS-320 must be running firmware version 1.0.2 with the photo center module active and web interface exposed. Devices placed behind a NAT router with no port forwarding and no UPnP-based exposure are not directly reachable from the internet, which is the primary natural barrier limiting exploitation breadth. No special server-side configuration beyond the default firmware state appears to be required.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L and E:P) scores 6.9, indicating network-accessible, zero-interaction unauthenticated exploitation with an exploit proof-of-concept confirmed present - a combination that elevates operational risk beyond what the medium score implies. The low VC/VI/VA metrics suggest the reporter assessed direct impact on the device as limited, potentially because follow-on code execution was not independently confirmed; however, CWE-434 on a PHP-based NAS web server is widely understood to enable web shell deployment, making the conservative impact scoring suspect - this discrepancy should be verified against the actual PoC behavior. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified numerically. KEV status is not listed, meaning confirmed active exploitation by threat actors is not established by CISA at time of analysis. The availability of a public PoC (hosted on a Feishu document) meaningfully lowers the technical barrier for exploitation. Overall: the realistic risk to any internet-exposed DNS-320 is higher than the CVSS score suggests, but the limited enterprise deployment footprint of this specific older SOHO NAS model constrains the population at risk.

An attacker targeting an internet-exposed D-Link DNS-320 sends a crafted HTTP multipart POST request to /photo_center/php/uploadify.php, manipulating the 'Malicious Handler' argument to upload a PHP web shell without any prior authentication. The attacker then makes a subsequent HTTP GET request to the uploaded file's path on the device, executing arbitrary OS commands with the web server's privileges and achieving persistent access to the NAS and its stored data. A public proof-of-concept demonstrating this technique is available via a Feishu document linked in the CVE references.