D-Link DNS-320 CVE-2026-16331

No special conditions are required beyond network reachability of the device's web management interface - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation against the default configuration of D-Link DNS-320 firmware 1.0.2. No specific feature flag, non-default setting, or privileged account is required; the vulnerable endpoint /web/function/save_ajax.php is part of the standard management interface. The primary limiting factor is network exposure: devices not accessible from the attacker's network (e.g., behind NAT with no port forwarding, or firewall-restricted management ports) cannot be directly targeted. Authentication requirements are not confirmed from description text alone, but the CVSS 4.0 PR:N metric indicates no credentials are needed.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated exploitation with no attack complexity - the highest-risk access profile possible. However, the base impact metrics (VC:L/VI:L/VA:L) appear to underestimate real-world consequences: unrestricted PHP file upload on a web server almost universally enables webshell deployment and full remote code execution, which would justify higher impact ratings. This discrepancy should be noted by defenders - the 6.9 CVSS 4.0 score likely underrepresents actual blast radius. The E:P supplemental metric confirms public proof-of-concept availability, further elevating practical exploitability. No CISA KEV listing exists at time of analysis, so widespread active exploitation is not confirmed, but POC availability combined with a no-authentication, no-complexity attack vector makes opportunistic exploitation plausible. Critically, the DNS-320 is end-of-life, meaning no vendor patch will be issued - residual risk is permanent for unmitigated deployments.

An attacker scans for internet-exposed D-Link DNS-320 devices, then sends a crafted unauthenticated HTTP POST to /web/function/save_ajax.php with a PHP webshell as the uploaded file, exploiting the absent file-type validation. The server stores the file in a web-accessible location; the attacker retrieves it via HTTP to trigger server-side execution, yielding persistent remote code execution on the NAS. A public proof-of-concept has been disclosed, making this accessible to low-skilled attackers.