# CVE-2026-16448: D-Link NAS and NVR command injection in remote_backup.cgi

Source: https://junglewise.ai/threats/cve-2026-16448-d-link-nas-and-nvr-command-injection-in-remote-backup-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-16448 · Severity: medium · CVSS 6.3 · Published 2026-07-21

A security vulnerability exists in several D-Link Network Attached Storage (NAS) and Network Video Recorder (NVR) devices. These devices are used to store files and manage security camera footage. An attacker could exploit this flaw to execute unauthorized commands on the device, potentially leading to data theft, service disruption, or full system compromise. Public exploit code is currently available, increasing the risk of an attack.

## Quick answers

**Is CVE-2026-16448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16448 being exploited in the wild.

**How severe is CVE-2026-16448?** Medium severity, with a CVSS score of 6.3, published 21 July 2026.

**Which products and versions are affected?** D-Link DNS-120 up to 20260205; D-Link DNR-202L up to 20260205; D-Link DNS-315L up to 20260205; D-Link DNS-320 up to 20260205; and 5 more.

**Is there a fix for CVE-2026-16448?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16448 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16448?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the 'cgi_check_rsync_rw' function within the '/cgi-bin/remote_backup.cgi' file of various D-Link NAS and NVR models. The vulnerability is triggered by improper sanitization of the 'ip' argument. A remote attacker with low privileges can manipulate this parameter to inject and execute arbitrary system commands on the underlying operating system. The exploit has been publicly disclosed, and the vulnerability affects firmware versions up to 20260205. No official patch is currently noted in the advisory, though these devices are often legacy products.

## Affected products

- D-Link DNS-120 up to 20260205
- D-Link DNR-202L up to 20260205
- D-Link DNS-315L up to 20260205
- D-Link DNS-320 up to 20260205
- D-Link DNS-320L/LW up to 20260205
- D-Link DNS-321/323/325/326/327L up to 20260205
- D-Link DNR-322L/326 up to 20260205
- D-Link DNS-340L/343/345 up to 20260205
- D-Link DNS-726-4/1100-4/1200-05/1550-04 up to 20260205

## Timeline

- 2026-07-21: advisory: Initial publication of the vulnerability details.

## References

- [https://ucn9h68n9289.feishu.cn/docx/OfhNdwzvXoBlJBxDIW7clVmjnuh?from=from_copylink](https://ucn9h68n9289.feishu.cn/docx/OfhNdwzvXoBlJBxDIW7clVmjnuh?from=from_copylink)
- [https://vuldb.com/cve/CVE-2026-16448](https://vuldb.com/cve/CVE-2026-16448)
- [https://vuldb.com/submit/858469](https://vuldb.com/submit/858469)
- [https://vuldb.com/vuln/380827](https://vuldb.com/vuln/380827)
- [https://vuldb.com/vuln/380827/cti](https://vuldb.com/vuln/380827/cti)
- [https://www.dlink.com/](https://www.dlink.com/)