Is there a public PoC exploit available for CVE-2026-8272?

Yes, a public proof-of-concept exploit is available for CVE-2026-8272. Prioritise patching immediately. EPSS: 0.1%.

D-Link DNS-320 CVE-2026-8272

Q: What is the CVSS score of CVE-2026-8272?

CVE-2026-8272 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29030 LOW

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-5mhr-g92v-jpjf

D-Link Command Injection

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 05:30 vuln.today

Severity Changed

May 11, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 05:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

CVE Published

May 11, 2026 - 04:15 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in D-Link DNS-320 2.06B01 webfile_mgr.cgi allows remote authenticated attackers with high privileges to execute arbitrary commands through manipulated file operation parameters (delete, rename, copy, move, chmod, chown). Publicly available exploit code exists; CVSS 2.0 reflects high privilege requirement and limited confidentiality/integrity impact on the vulnerable system only.

Technical ContextAI

The vulnerability exists in the CGI script /cgi-bin/webfile_mgr.cgi, which handles file management operations on the D-Link DNS-320 network-attached storage device. CWE-78 (OS Command Injection) indicates that user-supplied input from file operation parameters is passed unsanitized to shell command execution functions, likely without proper quoting or parameterization. The file operations (delete, rename, copy, move, chmod, chown) are system-level functions that typically invoke shell commands to manipulate the filesystem. The CPE cpe:2.3:a:d-link:dns-320 indicates the vulnerability affects the DNS-320 product line; version 2.06B01 is explicitly confirmed as vulnerable.

RemediationAI

Upgrade D-Link DNS-320 to a patched firmware version released by D-Link after firmware 2.06B01; exact patched version not independently confirmed from available data - contact D-Link directly at https://www.dlink.com/ for the current recommended firmware version. If a patch is unavailable, restrict network access to the webfile_mgr.cgi script by implementing firewall rules to permit only trusted administrator IP addresses to reach port 80/443 on the DNS-320. Disable the webfile_mgr.cgi service entirely if web-based file management is not required; this eliminates the attack surface. Additionally, enforce strong administrative credentials and multi-factor authentication if the device supports it, and monitor administrator login attempts to detect unauthorized access.