D-Link DNS-320 CVE-2026-8272

Exploitation requires valid administrator (high-privilege) authentication to the D-Link DNS-320 web interface; unauthenticated remote exploitation is not possible. The webfile_mgr.cgi script must be accessible over the network (typically HTTP port 80 or HTTPS port 443). The attacker must be able to craft and submit a request to one of the vulnerable file operation functions (delete, rename, copy, move, chmod, or chown) with malicious input. Default DNS-320 configurations with web management enabled and no network segmentation are vulnerable; air-gapped or behind-firewall deployments with restricted access are substantially less at risk.

Real-world risk is substantially lower than raw CVSS score indicates. CVSS vector shows AV:N (network-accessible) but PR:H (requires high privileges - administrator level) and limited impact scope (VC:L, VI:L, VA:L - only the vulnerable system's confidentiality, integrity, and availability affected). The E:P (Exploit: Proof-of-Concept) designation confirms public exploit availability. CVSS 2.0 score appears anomalously low and may reflect the severity rating logic; however, the privilege requirement significantly restricts real-world exploitation to administrators already on the device, limiting external threat vectors. Active exploitation status is not confirmed in CISA KEV. The practical threat is primarily to organizations where an administrator has been compromised or acts maliciously, or where the DNS-320 is deployed in an untrusted network environment. For most users, the privilege barrier substantially mitigates risk despite network accessibility.

An attacker who has obtained or guessed valid administrator credentials (or who gains them through phishing or credential compromise) logs into the D-Link DNS-320 web interface. The attacker then crafts a malicious request to /cgi-bin/webfile_mgr.cgi with an OS command injection payload embedded in a file operation parameter (e.g., a filename or chmod mode string containing shell metacharacters and commands). The vulnerable script executes the injected command on the device with the privileges of the web server process, allowing arbitrary code execution.