PT-2026-39570 · D Link · Dns-320

St4R · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-8271

Mitre

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi speed/cgi dhcpd lease/cgi ddns/cgi set ip/cgi upnp del/cgi dhcpd/cgi upnp add/cgi upnp edit of the file /cgi-bin/network mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-8271

Affected Products

Dns-320

References · 6

• 🔥 https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20network_mgr.cgi%20Multiple%20OS%20Command%20Injection%20Vulnerabilities.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8271 · Security Note
• https://dlink.com · Note
• https://vuldb.com/submit/810078 · Note
• https://vuldb.com/vuln/362568/cti · Note
• https://vuldb.com/vuln/362568 · Note