# CVE-2026-82689: D-Link DNS ShareCenter OS command injection in isomount_mgr.cgi

Source: https://junglewise.ai/threats/cve-2026-82689-d-link-dns-sharecenter-os-command-injection-in-isomount-mgr-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82689 · Severity: critical · CVSS 9.9 · Published 2026-08-31

D-Link DNS ShareCenter is a network-attached storage appliance used for file sharing and backup in small to medium businesses. The ISO Image Handler component contains a remote OS command injection vulnerability in the isomount_mgr.cgi script that allows unauthenticated attackers to execute arbitrary commands on the device, leading to complete system compromise and potential data theft or destruction.

Technologies: [D-Link DNS-320L](https://junglewise.ai/threats/technologies/dns-320l), [D-Link DNS-327L](https://junglewise.ai/threats/technologies/dns-327l), [D-Link DNS-340L](https://junglewise.ai/threats/technologies/dns-340l), [D-Link DNS-345](https://junglewise.ai/threats/technologies/dns-345). Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-82689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82689 being exploited in the wild.

**How severe is CVE-2026-82689?** Critical severity, with a CVSS score of 9.9, published 31 August 2026.

**Which products and versions are affected?** D-Link DNS-320L up to 20260717; D-Link DNS-327L up to 20260717; D-Link DNS-340L up to 20260717; D-Link DNS-345 up to 20260717.

**Is there a fix for CVE-2026-82689?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82689 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82689?** Check whether you run D-Link DNS-320L, D-Link DNS-327L, D-Link DNS-340L or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in the /cgi-bin/isomount_mgr.cgi script within the ISO Image Handler component. The upIsoRootPath parameter is not properly sanitized, allowing an attacker to inject shell metacharacters and execute arbitrary OS commands remotely without authentication. The attack vector is network-based, requiring only network connectivity to the affected device. A successful exploit grants the attacker command execution with the privileges of the web server process, potentially allowing full system control. The vulnerability affects D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices up to firmware version 20260717; patch availability has not been confirmed in the advisory.

## Affected products

- D-Link DNS-320L up to 20260717
- D-Link DNS-327L up to 20260717
- D-Link DNS-340L up to 20260717
- D-Link DNS-345 up to 20260717

## Timeline

- 2026-08-31: disclosed: Vulnerability published and exploit made public

## References

- [https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md](https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md)
- [https://vuldb.com/cve/CVE-2026-82689](https://vuldb.com/cve/CVE-2026-82689)

## Related threats

- [D-Link DNS-340L OS command injection in dropbox.cgi](https://junglewise.ai/threats/cve-2026-85223-d-link-dns-340l-os-command-injection-in-dropbox-cgi)
- [D-Link DNS-340L OS command injection in addon_center.cgi](https://junglewise.ai/threats/cve-2026-85222-d-link-dns-340l-os-command-injection-in-addon-center-cgi)
- [D-Link DNS-340L and DNS-345 OS command injection in iscsi_mgr.cgi](https://junglewise.ai/threats/cve-2026-82692-d-link-dns-340l-and-dns-345-os-command-injection-in-iscsi-mgr-cgi)
- [D-Link DNS-320L DNS-327L DNS-340L DNS-345 OS command injection in CGI handler](https://junglewise.ai/threats/cve-2026-82691-d-link-dns-320l-dns-327l-dns-340l-dns-345-os-command-injection-in)
- [D-Link DNS-327L and DNS-340L OS command injection in ve_mgr.cgi](https://junglewise.ai/threats/cve-2026-82690-d-link-dns-327l-and-dns-340l-os-command-injection-in-ve-mgr-cgi)