D-Link DNS-320 EUVD-2026-29031

Q: What is the CVSS score of EUVD-2026-29031?

EUVD-2026-29031 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-8273 MEDIUM

OS Command Injection (CWE-78)

2026-05-11 VulDB

GHSA-5jp6-jc7m-x7q9

D-Link Command Injection

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 05:30 vuln.today

CVSS changed

May 11, 2026 - 05:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

CVE Published

May 11, 2026 - 04:30 nvd

MEDIUM 5.1

DescriptionCVE.org

A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.

AnalysisAI

OS command injection in D-Link DNS-320 firmware 2.06B01 allows remote authenticated administrators to execute arbitrary system commands via unsanitized input to multiple CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) in /cgi-bin/system_mgr.cgi. CVSS 5.1 reflects high-privileged access requirement (PR:H) mitigating network-accessible attack vector; however, the ability to inject OS commands via CGI endpoints creates significant risk in multi-user or compromised-admin scenarios. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability resides in the system_mgr.cgi web interface of the D-Link DNS-320 network storage device, which handles administrative functions including host configuration, NTP settings, fan control, and user management. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input to multiple CGI parameters is passed directly or insufficiently sanitized to system shell commands. The DNS-320 is a SOHO NAS appliance that exposes CGI endpoints for remote management; the affected functions process admin-supplied configuration data without proper escaping or validation, allowing shell metacharacters (backticks, pipes, semicolons, command substitution) to break out of intended commands and execute arbitrary code in the context of the web server process (typically root on embedded Linux).

RemediationAI

Immediate action: contact D-Link support at https://www.dlink.com/ to obtain a patched firmware version for DNS-320; no fixed version is currently documented in the public record. Pending patch availability, implement network-level mitigations: (1) Restrict network access to /cgi-bin/system_mgr.cgi to trusted IP addresses only using firewall or local ACLs-disable remote administrative access if feasible and rely on local management; (2) Change administrative credentials to a strong, unique password and audit login logs for unauthorized access; (3) Disable unused CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) if not actively required, or block HTTP POST requests to these endpoints at the firewall; (4) Monitor system logs for suspicious command execution (e.g., unexpected processes, network connections from root user); (5) Segment the DNS-320 onto a restricted management VLAN separate from production workstations. These mitigations assume the admin account itself has not been compromised; if breach is suspected, assume arbitrary code execution and plan incident response accordingly.