Is there a public PoC exploit available for CVE-2026-8271?

Yes, a public proof-of-concept exploit is available for CVE-2026-8271. Prioritise patching immediately. EPSS: 0.2%.

D-Link DNS-320 CVE-2026-8271

Q: What is the CVSS score of CVE-2026-8271?

CVE-2026-8271 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-29029 LOW

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-55jg-7rxj-hh46

Command Injection D-Link Dns 320 D-Link

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 05:30 vuln.today

Severity Changed

May 11, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 05:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

CVE Published

May 11, 2026 - 04:00 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated attackers with high privileges to execute arbitrary system commands via multiple CGI parameters in /cgi-bin/network_mgr.cgi (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit). Publicly available exploit code exists and the vulnerability has been documented with proof-of-concept on GitHub.

Technical ContextAI

D-Link DNS-320 is a network-attached storage (NAS) device that exposes administrative CGI scripts for network configuration via a web interface at /cgi-bin/network_mgr.cgi. The vulnerability stems from insufficient input validation in multiple CGI handler functions that process network configuration parameters (IP settings, DHCP leases, DDNS configuration, UPnP control). These parameters are passed unsanitized to system command execution functions, violating CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The attack vector is network-based but requires high privilege authentication, indicating this affects administratively-accessible web interfaces of the device.

RemediationAI

Upgrade D-Link DNS-320 to a patched firmware version released by D-Link. However, no specific patched version number is confirmed in the available advisory data; users should check the official D-Link support page (https://www.dlink.com/) for the latest firmware release addressing CVE-2026-8271 and apply immediately. Until a patch is available or confirmed, restrict network access to the DNS-320 web interface (/cgi-bin/network_mgr.cgi) by implementing firewall rules to limit administrative access to trusted internal IPs only, and disable remote administration if enabled. Change default and weak administrative credentials to strong, unique passwords. Monitor admin account activity for anomalous CGI parameter submissions to the vulnerable functions (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit). Mitigation trade-off: blocking CGI script access entirely will disable network configuration via web interface, requiring console or SSH access for administration.