D-Link DNS-340L CVE-2026-85222

Exploitation requires administrator-level authentication to the D-Link DNS-340L web management interface (CVSS 4.0 PR:H). The attacker must have network connectivity to the device's HTTP management port (AV:N, AC:L, AT:N). No user interaction beyond the attacker's own authenticated session is required. The specific vulnerable surface is the Add-On Center feature at /cgi-bin/addon_center.cgi; exploitation is limited to this endpoint. The primary constraint is the admin credential prerequisite - however, unchanged factory default credentials, widely documented for D-Link consumer devices, trivially satisfy this requirement and should be treated as a realistic exploitation pathway rather than a meaningful barrier.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) characterizes this as network-exploitable with low complexity but requiring administrator-level authentication, which is the primary barrier against mass automated exploitation. The comprehensive impact scores (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflect the realistic consequence of root-level command execution on a NAS device: complete data exfiltration, ransomware staging, or persistent backdoor installation. The supplemental E:P modifier confirms a public PoC exists, meaningfully lowering the skill bar for exploitation. EPSS data is absent from the provided inputs, so numerical exploitation probability cannot be quantified. The end-of-life status of the DNS-340L is the most consequential risk multiplier: absent a vendor patch, affected devices will remain permanently exposed, and even a mid-sized municipal IT team in sopot running legacy NAS infrastructure should treat decommissioning or network isolation as an urgent remediation priority. The PR:H prerequisite remains the key mitigating factor, but default or reused admin credentials on consumer NAS devices frequently nullify this protection in practice.

An attacker who has obtained DNS-340L admin credentials - through credential reuse, phishing, or exploitation of unchanged factory defaults - authenticates to the device's web management interface and submits a crafted HTTP POST to /cgi-bin/addon_center.cgi with a shell metacharacter payload embedded in the f_url or f_name parameter. The CGI handler passes the unsanitized value directly into a shell command, executing arbitrary code as the NAS process user (typically root). A public PoC on GitHub documents this technique, reducing the skill requirement for exploitation to script-kiddie level once credentials are available.