Which versions of D-Link DNS-340L are affected by CVE-2026-85223?

The D-Link DNS-340L NAS in firmware version 1.01B04 contains an OS command injection vulnerability that allows authenticated network users to execute arbitrary operating system commands with…

Is there a public PoC exploit available for CVE-2026-85223?

Yes, a public proof-of-concept exploit is available for CVE-2026-85223. Prioritise patching immediately. EPSS: 1.6%.

How to fix or mitigate CVE-2026-85223?

Within 24 hours, scan your network for all D-Link DNS-340L devices and document their current firmware versions and network connectivity. Within 7 days, isolate any devices running firmware 1.01B04 to trusted-only network segments, implement firewall rules to deny access to the `/cgi-bin/dropbox.cgi` endpoint and related CGI handlers, disable Dropbox synchronization features if operationally feasible, and review authentication logs for evidence of exploitation attempts targeting the affected endpoint. Within 30 days, develop a formal decommissioning timeline for affected devices and procure replacement NAS solutions with active vendor support, as no vendor-released patch is available for this end-of-life product.

D-Link DNS-340L CVE-2026-85223

Q: What is the CVSS score of CVE-2026-85223?

CVE-2026-85223 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.6%.

EUVD-2026-70766 HIGH

OS Command Injection (CWE-78)

2026-09-03 VulDB

GHSA-hq96-v7ff-6hfp

Command Injection D-Link Dns 340l D-Link

8.6

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.6 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable CGI endpoint with low-privilege auth (PR:L); OS command injection on embedded NAS implies scope change and full system compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 04, 2026 - 11:21 vuln.today

Analysis Updated

Sep 03, 2026 - 22:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 03, 2026 - 22:22 vuln.today

cvss_changed

Severity Changed

Sep 03, 2026 - 22:22 NVD

CRITICAL HIGH

CVSS changed

Sep 03, 2026 - 22:22 NVD

9.4 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Sep 03, 2026 - 21:51 vuln.today

CVE Published

Sep 03, 2026 - 21:15 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Articles & Coverage 2

News 3 New D-Link Vulnerabilities - 3 High Severity, 2 With POC Sep 04, 2026 News 3 New D-Link Vulnerabilities - 3 High Severity, 2 With POC Sep 03, 2026

AnalysisAI

OS command injection in D-Link DNS-340L firmware 1.01B04 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the callback_url or sync_interval arguments passed to the /cgi-bin/dropbox.cgi CGI handler. A public proof-of-concept exploit exists, raising the likelihood of opportunistic exploitation against exposed NAS devices. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must hold low-privilege authenticated access to the NAS web interface (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable exploitation requiring only low-privilege authentication with no attack complexity - a meaningful but not insurmountable barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.