Which versions of D-Link DNS NAS are affected by CVE-2026-82691?

D-Link NAS storage devices in the DNS-3xx series-widely deployed in SMBs and remote offices-face unauthorized command execution risk; any authenticated user can exploit a known vulnerability to gain…

Is there a public PoC exploit available for CVE-2026-82691?

Yes, a public proof-of-concept exploit is available for CVE-2026-82691. Prioritise patching immediately. EPSS: 2.1%.

How to fix or mitigate CVE-2026-82691?

Within 24 hours, inventory all D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices in your environment and assess their criticality and current administrative access patterns. Within 7 days, isolate these devices on a dedicated VLAN and restrict network access via firewall rules to authorized administrative hosts only; disable remote protocols including SSH, HTTP/HTTPS web UI, and UPS monitoring from untrusted networks. Within 30 days, execute a hardware replacement plan or, if replacement is not feasible, deploy continuous network monitoring to detect exploitation attempts such as unusual process spawning or unexpected outbound connections originating from these devices.

D-Link DNS NAS CVE-2026-82691

Q: What is the CVSS score of CVE-2026-82691?

CVE-2026-82691 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-68485 HIGH

OS Command Injection (CWE-78)

2026-08-31 VulDB

GHSA-vgqw-w77q-phfq

Command Injection D-Link Dns 320l Dns 327l Dns 340l Dns 345 D-Link

8.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-accessible CGI endpoint (AV:N, AC:L); admin credentials required (PR:H); scope change to subsequent systems justified by full high subsequent-system impact in CVSS 4.0 source data.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Aug 31, 2026 - 15:24 vuln.today

Analysis Updated

Aug 31, 2026 - 12:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 31, 2026 - 12:22 vuln.today

cvss_changed

Severity Changed

Aug 31, 2026 - 12:22 NVD

CRITICAL HIGH

CVSS changed

Aug 31, 2026 - 12:22 NVD

9.4 (CRITICAL) 8.5 (HIGH)

Analysis Generated

Aug 31, 2026 - 12:16 vuln.today

CVE Published

Aug 31, 2026 - 11:45 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Articles & Coverage 2

News 6 New D-Link Vulnerabilities - 6 High Severity, All With POC Sep 01, 2026 News 8 New D-Link Vulnerabilities - 8 High Severity, 7 With POC Aug 31, 2026

AnalysisAI

OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the f_ups_ip argument passed to /cgi-bin/usb_device.cgi. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires authenticated access to the device's web management interface with administrative privileges (PR:H per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.5 reflects a genuine high-severity finding with a nuanced profile: AV:N (network reachable), AC:L (no special conditions), PR:H (admin-level authentication required), and full high-impact scores across vulnerable and subsequent systems (VC/VI/VA/SC/SI/SA all H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices in your environment and assess their criticality and current administrative access patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.