PT-2026-39571 · D Link · Dns-320

St4R · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-8272

Mitre

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-8272

Affected Products

Dns-320

References · 6

• 🔥 https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20webfile_mgr.cgi%20Multiple%20OS%20Command%20Injection%20via%20File%20Operations.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8272 · Security Note
• https://dlink.com · Note
• https://vuldb.com/submit/810079 · Note
• https://vuldb.com/vuln/362569/cti · Note
• https://vuldb.com/vuln/362569 · Note