Is there a public PoC exploit available for CVE-2026-16331?

Yes, a public proof-of-concept exploit is available for CVE-2026-16331. Prioritise patching immediately. EPSS: 0.7%.

D-Link DNS-320 CVE-2026-16331

Q: What is the CVSS score of CVE-2026-16331?

CVE-2026-16331 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-46138 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-21 VulDB

GHSA-hfvv-f4x9-469c

D-Link PHP File Upload Dns 320

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unrestricted PHP file upload enables webshell deployment and full RCE; unauthenticated network access with scope change justifies S:C and high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 21, 2026 - 01:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 01:16 vuln.today

CVE Published

Jul 21, 2026 - 00:45 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the /web/function/save_ajax.php endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.

Technical ContextAI

The D-Link DNS-320 is a consumer/SMB Network Attached Storage device with a PHP-based web management interface. The vulnerable endpoint /web/function/save_ajax.php is responsible for AJAX-driven save operations but fails to validate or restrict uploaded file types, falling squarely into CWE-434 (Unrestricted Upload of File with Dangerous Type). Because the web management interface is PHP-driven, an uploaded PHP file placed in a web-accessible directory can be directly executed by the server process, transforming an upload flaw into remote code execution. The CPE string cpe:2.3:a:d-link:dns-320:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the vendor has not scoped the vulnerability to a specific firmware branch - version 1.0.2 is the confirmed affected release per the VulDB report.

RemediationAI

No vendor-released patch has been identified for this vulnerability, consistent with the DNS-320's end-of-life status. The primary remediation is to decommission and replace the device with a currently supported NAS solution. If immediate replacement is not feasible, the device's web management interface (HTTP/HTTPS) must be isolated from all untrusted networks via firewall rules - this is the most effective compensating control, as it removes remote reachability entirely. Additionally, network-level access controls should restrict access to port 80/443 on the device to specific trusted management IPs only. Blocking the specific path /web/function/save_ajax.php via a web application firewall or reverse proxy can add a further layer if the device sits behind one, though this is not a substitute for network isolation. Note that none of these controls fix the underlying flaw - they only reduce attack surface. VulDB details are available at https://vuldb.com/vuln/380697.