Description

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T11:16:40.353Z",
  "pubdate": "2026-08-31T11:16:40.353Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the Virtual Volume Handler component of D-Link DNS-340L and DNS-345 network-attached storage devices. The vulnerability resides in the /cgi-bin/virtual_vol.cgi script, which fails to properly sanitize user-supplied input provided via the f_sharename, f_target, or f_name arguments. This flaw allows a remote, unauthenticated attacker to inject and execute arbitrary system commands with the privileges of the web server process. Successful exploitation can lead to full device compromise, unauthorized access to stored data, lateral movement within the network, and the potential for persistent control of the affected hardware. Due to the public disclosure of exploit material, the risk of exploitation by malicious actors is elevated. The vulnerability affects multiple firmware versions including 1.01B04, 1.03B06, 1.04.B02, and 1.05b04.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw originating from improper input validation within the Virtual Volume Handler of the D-Link DNS-340L and DNS-345 storage platforms. The vulnerable component is the /cgi-bin/virtual_vol.cgi script, which is responsible for managing virtual volume configurations. During the processing of HTTP GET or POST requests, the application accepts user-provided strings through the f_sharename, f_target, and f_name parameters. These parameters are subsequently concatenated into system shell commands without adequate sanitization, escaping, or neutralization of metacharacters such as backticks, semicolons, or pipe symbols.\nThe exploitation flow begins with the attacker crafting a malicious HTTP request targeting the /cgi-bin/virtual_vol.cgi endpoint. By embedding shell metacharacters and arbitrary commands into the f_sharename, f_target, or f_name fields, the attacker can break out of the intended command structure executed by the CGI script. When the server processes the request, the underlying operating system executes the attacker's injected command string. Because the web server process frequently operates with elevated or root-level privileges on these embedded devices, the attacker gains the ability to execute code with equivalent administrative control.\nThe technical impact involves the execution of arbitrary system commands, which allows the attacker to perform unauthorized file system operations, modify system configurations, retrieve sensitive configuration data, or install malicious persistence mechanisms such as web shells or backdoors. The exposure is categorized as remote, meaning an attacker does not require physical access to the device and can initiate the attack from any reachable network segment. The lack of robust input validation and command parameterization in the legacy CGI implementation serves as the primary root cause. Once the command injection is triggered, the attacker can leverage standard Unix command-line utilities to maintain a stable environment, exfiltrate data, or conduct further reconnaissance on the local area network, effectively bypassing standard authentication mechanisms that the web interface would otherwise enforce. The exploitation path does not require sophisticated bypasses, making it highly reliable for remote actors possessing the disclosed exploit details."
}