D-Link DNS-320 CVE-2026-16447

Exploitation requires network-layer access to the DNS-320 web management interface (typically TCP port 80 or 8080) and that the /web/jquery/uploader/multi_uploadify.php PHP endpoint is reachable and functional - no authentication is required, confirmed by the CVSS PR:N metric. No special configuration or non-default feature must be enabled; the upload endpoint is part of the standard web UI. Exploitation is bounded by network reachability: devices behind NAT with no port-forwarding rule to the management interface are not directly reachable from the internet, though they remain exploitable from a compromised internal host. Successful arbitrary file execution further requires that the web server serves uploaded files from a PHP-interpreted path, which is inherent to the device's embedded PHP web stack. Confirmed affected version is 1.0.2; other firmware versions are potentially affected per the CPE wildcard.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a maximally favorable attack surface: network-reachable, no complexity barriers, no authentication, and no user interaction - exploitable from the internet against any exposed device. The official impact metrics (VC:L/VI:L/VA:L) appear to be conservative and likely understate real-world impact; for a PHP-capable web server, successful arbitrary file upload translates directly to remote code execution, implying High impact across all CIA dimensions. The CVSS 4.0 threat supplement E:P confirms publicly available proof-of-concept exploit code (a Feishu-hosted document), meaningfully elevating the likelihood of exploitation by less sophisticated actors. KEV status is absent from available data, so confirmed active exploitation cannot be stated. The DNS-320 is a legacy SOHO NAS device, and D-Link has historically ceased firmware support for end-of-life products in this line, making a vendor patch unlikely. For any organization still operating this device on an internet-exposed interface, this should be treated as critical priority despite the moderate official score.

An unauthenticated attacker sends a crafted HTTP POST request to /web/jquery/uploader/multi_uploadify.php on an internet-exposed DNS-320, embedding a PHP web shell as the value of the Filedata[] multipart parameter; a publicly available proof-of-concept (referenced via Feishu document in the CVE references) demonstrates this technique. The server stores the uploaded file in a web-accessible directory and the attacker issues a follow-up GET request to the shell's path, obtaining arbitrary OS command execution on the device. Because no authentication is required, this attack can be scripted and executed against any reachable DNS-320 at internet scale.