PT-2026-39572 · D Link · Dns-320

St4R · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-8273

NVD

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi set host/cgi set ntp/cgi fan control/cgi merge user of the file /cgi-bin/system mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-8273

Affected Products

Dns-320

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8273 · Security Note
• https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20%20system_mgraccount_mgrdsk_mgrapp_mgr%20Multiple%20CGI%20OS%20Command%20Injection.md · Note
• https://dlink.com · Note
• https://vuldb.com/submit/810082 · Note
• https://vuldb.com/vuln/362570/cti · Note
• https://vuldb.com/vuln/362570 · Note