CVE-2026-82689 PUBLISHED

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

Assigner: VulDB
Reserved: 30.08.2026 Published: 31.08.2026 Updated: 31.08.2026

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CVSS Score: 9.4

Product Status

Vendor D-Link
Product DNS-320L
Versions
  • Version 20260717 is affected
Vendor D-Link
Product DNS-327L
Versions
  • Version 20260717 is affected
Vendor D-Link
Product DNS-340L
Versions
  • Version 20260717 is affected
Vendor D-Link
Product DNS-345
Versions
  • Version 20260717 is affected

Credits

  • ST4R0001 (VulDB User) reporter

References

Problem Types

  • OS Command Injection CWE
  • Command Injection CWE