D-Link DNS-340L CVE-2026-85223

The attacker must hold low-privilege authenticated access to the NAS web interface (CVSS PR:L confirmed). The /cgi-bin/dropbox.cgi CGI handler must be accessible - it is reachable over the network (AV:N) when the management interface is exposed. The Dropbox sync feature specifically must be present in the CGI handler, which is confirmed for firmware version 1.01B04. Exploitation is limited by the need for valid NAS credentials; however, legacy NAS devices frequently retain factory default credentials or use simple passwords, making this a realistic barrier to clear. No additional platform-specific or configuration-specific prerequisites are identified beyond authenticated network access to the web management port.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable exploitation requiring only low-privilege authentication with no attack complexity - a meaningful but not insurmountable barrier. The subsequent-system impact scores (SC:H/SI:H/SA:H) reflect the typical privilege context of CGI processes on embedded NAS firmware, where the OS command runs with near-root access. A public PoC exists (hosted on GitHub), which significantly elevates real-world exploitation risk beyond what the CVSS score alone conveys. The device has no confirmed vendor patch, and the DNS-340L is an aging product likely past end-of-life support. EPSS data is not provided; however, the combination of network-accessible NAS devices, a working public exploit, and absent patching makes this a credible exploitation target for opportunistic actors. The primary limiting factor is the low-privilege authentication requirement, which presumes an attacker has obtained NAS credentials - likely via credential stuffing or default credentials on legacy devices.

An attacker with valid credentials to the D-Link DNS-340L web interface - obtained via default credentials, credential stuffing, or prior compromise - sends a crafted HTTP request to /cgi-bin/dropbox.cgi with a shell metacharacter-laden callback_url or sync_interval parameter (e.g., callback_url=http://x.com; id; #). The CGI handler passes the unsanitized argument to an OS shell function, executing the injected command in the context of the web server process. A public PoC demonstrates this technique, lowering the skill bar for exploitation.