D-Link DNS-320 CVE-2026-85224

Exploitation requires valid high-privilege (administrator-level) credentials on the target device; the CVSS 4.0 PR:H metric confirms this is mandatory. The attacker must be able to reach the device's HTTP/CGI interface over the network (AV:N), meaning the management web interface must be accessible - either directly on the Internet or from the attacker's network segment. No user interaction is required once credentials are obtained. Exploitation is concretely limited by: (1) possession of valid high-privilege credentials (strongly mitigated by disabling default credentials and enforcing strong passwords), (2) network reachability of the CGI endpoint on TCP port 80 or 443, and (3) the target running affected firmware. In practice, the credential barrier is significantly reduced when default D-Link admin credentials remain in use, which is common on SOHO and legacy deployments.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) reflects a remotely reachable network endpoint with no attack complexity or user interaction required but mandates high-privilege credentials before exploitation is possible. The E:P threat metric confirms a public exploit exists, directly lowering the skill threshold for any attacker who can first satisfy the authentication requirement. Real-world risk is moderated by the PR:H constraint, yet D-Link consumer NAS appliances are historically deployed with default or weak administrator passwords and are frequently exposed to the Internet without compensating access controls; even a mid-sized municipal IT team in walbrzych managing a legacy NAS fleet should treat this as urgent, since credential guessing or password reuse can trivially satisfy PR:H in practice. The DNS-320 is a legacy product likely past its vendor support window, meaning no security patch may be forthcoming, which materially worsens the risk posture compared to a supported product with the same CVSS score. EPSS data and CISA KEV status are absent from the provided intelligence, so confirmed widespread exploitation cannot be established at this time; however, the combination of a public PoC, no patch, and legacy hardware with default credentials represents an elevated practical risk.

An attacker who obtains or guesses administrator credentials for a D-Link DNS-320 ShareCenter appliance - using default credentials, credential stuffing, or phishing - submits a crafted HTTP request to /cgi/file_sharing.cgi with shell metacharacters embedded in the fileurl parameter value. The CGI process passes the unsanitised input directly to an OS-level command interpreter, executing the injected payload with the privileges of the CGI process (typically root on embedded Linux NAS firmware). The publicly disclosed PoC documents the technique in detail, enabling low-skill attackers to reproduce the attack against any network-reachable device where credentials are known.