CVE-2026-8273
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A weakness has been identified in D-Link DNS-320 2.06B01 affecting the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes OS command injection, and the attack can be initiated remotely.
Risk Assessment
This may allow a remote attacker to execute arbitrary commands on the device.
Recommendation
Restrict access to the management interface and consider updating or replacing the device if no fix is available.
Other vulnerabilities in D-Link DNS-320
See all- CVE-2026-8272Medium
A security flaw has been discovered in D-Link DNS-320 2.06B01 affecting the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in OS command injection, the attack may be performed remotely, and the exploit has been released to the public.
- CVE-2026-8271Medium
A vulnerability was identified in D-Link DNS-320 2.06B01 affecting the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to OS command injection, the attack is possible remotely, and the exploit is publicly available.
- CVE-2020-25506CriticalActively exploited
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
- CVE-2019-16057CriticalActively exploited
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. An attacker can exploit this flaw to execute arbitrary commands on the system.
- CVE-2026-16447High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/jquery/uploader/multi_uploadify.php is vulnerable to unrestricted file upload via the Filedata[] argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16332High
A vulnerability was detected in D-Link DNS-320 1.0.2 in the file /mydlink/multi_uploadify.php. Manipulation of the argument Filedata[] results in unrestricted upload. The attack is remotely exploitable and the exploit is public.
- CVE-2026-16331High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/function/save_ajax.php is vulnerable to unrestricted file upload via the Malicious Handler argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16330High
A vulnerability has been found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the uploadify.php function. An attacker can remotely upload arbitrary files, potentially leading to device compromise.
- CVE-2026-16329High
A vulnerability in D-Link DNS-320 1.0.2 in the file /photo_center/php/uploadify.php allows unrestricted upload via manipulation of the Malicious Handler argument. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-16327High
A vulnerability was found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the /web/web_file/upload.php script. Manipulating the File argument allows remote attackers to upload arbitrary files without proper validation. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS