Executive brief
D-Link DNS-series network-attached storage devices contain a remote command injection vulnerability in their web-based management interface. An attacker can exploit this flaw by manipulating a parameter in the USB device configuration handler, allowing arbitrary operating system commands to be executed with device privileges. This could lead to complete compromise of the storage device, including data theft, deletion, or denial of service.
Technical details
The vulnerability is an OS command injection (CWE-78) in the CGI handler component, specifically in the /cgi-bin/usb_device.cgi script. The vulnerable parameter is f_ups_ip, which is not properly sanitized before being used in system commands. The attack is network-accessible and requires no authentication. An attacker can inject arbitrary shell commands through this parameter to achieve remote code execution with the privileges of the web server or device process. The exploit has been publicly disclosed.
Affected products
- D-Link DNS-320L up to 20260717
- D-Link DNS-327L up to 20260717
- D-Link DNS-340L up to 20260717
- D-Link DNS-345 up to 20260717
Timeline
- 2026-08-31: disclosed