D-Link DNS-340L CVE-2026-82692

Exploitation requires the attacker to authenticate to the D-Link NAS web interface with at least low-privilege credentials (PR:L per the provided CVSS 4.0 vector); this prerequisite is frequently satisfied by default or unchanged factory credentials common on consumer NAS devices. The iSCSI management CGI script (/cgi-bin/iscsi_mgr.cgi) must be reachable - it is present in the default firmware configuration for both models with no special activation required. No attack complexity preconditions (AC:L) or specific attack requirements (AT:N) beyond credential possession apply. Exploitation is constrained by the authentication requirement: fully unauthenticated exploitation is not supported by available CVSS data. Network isolation - placing the device behind a NAT or firewall that blocks external access to TCP 80/443 - substantially limits remote exploitation to LAN-resident or credential-holding attackers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H reflects a high-severity flaw that is network-reachable, requires no complex preconditions, and has full impact on both the vulnerable device and systems dependent on its storage - a scope change that amplifies blast radius beyond the NAS itself. The low-privilege requirement (PR:L) is a meaningful but often trivially bypassed barrier on consumer NAS equipment where default credentials remain unchanged; even a mid-sized municipal IT team in bytom operating these devices on a perimeter-adjacent VLAN should treat this as urgent given the public exploit disclosure. EPSS data was not provided, so quantified exploitation probability is unavailable; however, the combination of a public POC, consumer-grade device with historically poor patch hygiene, and network-accessible attack vector suggests meaningful opportunistic risk. The absence of a CISA KEV entry is a mild positive signal but not a reliable safety indicator given that consumer NAS exploitation is often underreported. No CVSS 3.x base score was provided alongside the 4.0 score; independent assessment using consistent metrics is recommended.

An attacker who has obtained low-privilege credentials - including default factory credentials such as admin/admin that are frequently left unchanged - sends a crafted HTTP POST request to /cgi-bin/iscsi_mgr.cgi with a shell-metacharacter-injected value in the volume_location or alias parameter. The CGI handler passes the unsanitized input to a shell command, causing the device to execute attacker-controlled instructions, which can include adding a backdoor account, exfiltrating stored data, or pivoting to other systems via the iSCSI network fabric. A public proof-of-concept exploit is available, meaning this scenario requires minimal technical sophistication.