Executive brief
D-Link DNS-340L and DNS-345 are network-attached storage devices used to centralize file storage and sharing in corporate environments. A remote attacker can execute arbitrary OS commands on the device without authentication by sending specially crafted requests to the Virtual Volume Handler component, gaining full control over the storage device and any data it contains.
Technical details
The vulnerability is an OS command injection flaw in the /cgi-bin/virtual_vol.cgi script within the Virtual Volume Handler component. The vulnerable parameters (f_sharename, f_target, f_name) are not properly sanitized before being passed to shell commands, allowing an attacker to inject arbitrary commands. Remote exploitation requires network access to the affected device's web interface; no authentication is required. A successful exploit grants the attacker OS-level code execution with the privileges of the web server process. Patches or firmware updates are recommended to validate and sanitize all user inputs.
Affected products
- D-Link DNS-340L 1.01B04, 1.03B06, 1.04.B02, 1.05b04
- D-Link DNS-345 1.01B04, 1.03B06, 1.04.B02, 1.05b04
Timeline
- 2026-08-31: disclosed