D-Link DNS-320 CVE-2026-16330

No authentication is required and no special device configuration is needed - any DNS-320 at firmware 1.0.2 with its web management interface reachable over a network is exploitable by default (PR:N/AC:L/AT:N confirmed by CVSS 4.0 vector). The sole prerequisite is network-level access to the device's HTTP or HTTPS management port; devices directly internet-facing are at highest risk, while devices restricted to isolated internal networks behind a firewall that blocks untrusted inbound access have meaningfully reduced exposure. There is no required user interaction (UI:N), no specific feature toggle needed, and no privileged session to hijack. The limiting factor for exploitation is purely network reachability - defenders who cannot immediately patch should treat firewall isolation of the management interface as the primary control.

The official CVSS 4.0 score of 6.9 with all-Low impact ratings (VC:L/VI:L/VA:L) materially understates real-world risk for this vulnerability class. CWE-434 on a PHP-enabled, web-accessible upload endpoint almost universally yields remote code execution upon successful file upload, implying High impacts across confidentiality, integrity, and availability - this discrepancy should be independently verified but is flagged here as a likely scoring artifact. The access characteristics from the CVSS 4.0 vector are unambiguous worst-case: AV:N/AC:L/AT:N/PR:N/UI:N confirms unauthenticated, low-complexity, network-based exploitation with no special conditions or user interaction required. The E:P modifier confirms a public proof-of-concept exists, directly lowering the skill threshold for exploitation. CISA KEV listing is not confirmed in the available data, so active exploitation in the wild cannot be stated as confirmed - however, the combination of unauthenticated network access, public exploit code, and an unpatched legacy device represents a high actual exploitation risk. The absence of a vendor advisory and probable EOL status of the device means no vendor-supported fix is likely forthcoming.

An attacker identifies a DNS-320 device with its web interface exposed to the internet using a scan tool or Shodan query, then sends a crafted unauthenticated HTTP POST request to /web/jquery/uploader/uploadify.php containing a PHP webshell as the uploaded file payload. The server accepts and stores the file without type validation; the attacker issues a subsequent HTTP GET request to the uploaded file's web-accessible path, triggering server-side PHP execution and gaining an interactive command shell on the NAS with web server process privileges. A public proof-of-concept documenting this technique has been released, making the attack reproducible by low-skilled adversaries.