Description

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T12:17:57.763Z",
  "pubdate": "2026-08-31T12:17:57.763Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the ISO Image Handler component of multiple D-Link Network Attached Storage (NAS) devices, including the DNS-320L, DNS-327L, DNS-340L, and DNS-345.\nThe vulnerability originates from the insecure processing of user-supplied input within the '/cgi-bin/isomount_mgr.cgi' script.\nSpecifically, the 'upIsoRootPath' argument fails to implement adequate input validation or sanitization before passing data to system-level calls.\nThis flaw allows a remote, unauthenticated attacker to execute arbitrary system commands with the privileges of the underlying web server process.\nSuccessful exploitation results in full remote code execution, enabling an adversary to gain unauthorized access to the NAS device, exfiltrate sensitive data, manipulate stored files, or leverage the device as a pivot point within the local network.\nGiven that the exploit is public, the risk to exposed devices is critical.",
  "technicalDetails": "The vulnerability resides in the '/cgi-bin/isomount_mgr.cgi' component, which serves as an interface for managing ISO images on affected D-Link NAS devices.\nThe root cause is an improper neutralization of special elements used in an OS command ('OS Command Injection', CWE-78). The application processes the 'upIsoRootPath' parameter by passing it directly or via concatenated strings to a system utility, likely a shell execution function such as 'system()', 'popen()', or 'exec()' without sufficient sanitization.\nAn attacker can exploit this by crafting a malicious HTTP request targeting the isomount_mgr.cgi endpoint. By injecting shell metacharacters—such as semicolons, pipes, or backticks—into the 'upIsoRootPath' argument, the attacker can break out of the intended command context.\nFor example, a payload crafted as 'upIsoRootPath=; [command];' would result in the host operating system executing the attacker's arbitrary command following the legitimate ISO mounting logic.\nThe attack flow follows a predictable sequence: First, the attacker identifies the target device's web interface. Second, the attacker sends a crafted POST or GET request to the vulnerable CGI script, embedding the malicious shell command within the specified parameter. Third, the web server executes the command with its elevated privileges, typically as 'root' or a high-privileged service user. Finally, the command execution occurs, and the attacker receives the output or achieves the desired side effect on the file system.\nBecause the interface is reachable remotely, the network exposure is significant if the NAS management console is exposed to the WAN. The exploit does not require prior authentication, significantly lowering the barrier to entry for adversaries. The post-exploitation impact includes persistent compromise of the NAS device, potential lateral movement into the local network environment, and complete loss of data confidentiality, integrity, and availability."
}