Is there a public PoC exploit available for CVE-2026-16332?

Yes, a public proof-of-concept exploit is available for CVE-2026-16332. Prioritise patching immediately. EPSS: 0.5%.

D-Link DNS-320 CVE-2026-16332

Q: What is the CVSS score of CVE-2026-16332?

CVE-2026-16332 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-46143 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-21 VulDB

GHSA-2vj5-chrh-vh25

D-Link PHP File Upload Dns 320

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

CWE-434 in a PHP handler enables webshell upload and execution, warranting I:H; C:L and A:L align with the limited scope of a consumer NAS device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 21, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 02:45 vuln.today

CVE Published

Jul 21, 2026 - 01:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the /mydlink/multi_uploadify.php PHP endpoint, where the Filedata[] parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.

Technical ContextAI

The DNS-320 is a D-Link network-attached storage device running a PHP-based management interface. The vulnerable endpoint /mydlink/multi_uploadify.php is a multi-file upload handler that fails to enforce server-side validation of file type or content, falling squarely under CWE-434 (Unrestricted Upload of File with Dangerous Type). In PHP environments, this class of vulnerability is critically dangerous because an attacker-controlled .php file placed in a web-accessible directory can be subsequently requested over HTTP to trigger arbitrary server-side code execution. The CPE cpe:2.3:a:d-link:dns-320:*:*:*:*:*:*:*:* with the wildcard version qualifier suggests NVD has not bounded the affected scope beyond the reported 1.0.2 release. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable remotely with no prerequisites, while the E:P modifier confirms that exploit code is publicly available.

RemediationAI

No vendor-released patch has been identified at time of analysis; the DNS-320 is a legacy device and may be end-of-life with no forthcoming fix. Owners should first check https://www.dlink.com/ for any updated firmware advisory. As a primary compensating control, the device's web management interface - particularly the /mydlink/ path - should be blocked from all untrusted networks at the perimeter firewall; this eliminates the remote attack surface without affecting local NAS file-sharing functionality. If the device does not require remote management, disable the mydlink cloud feature entirely via the device settings, which may disable or restrict the vulnerable PHP endpoint. Replacing the device with a supported NAS product is strongly recommended, as a device with an unpatched public exploit and no vendor support represents a persistent and unmitigable risk on any internet-facing segment.