Description

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T12:17:58.163Z",
  "pubdate": "2026-08-31T12:17:58.163Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the CGI handler component of several D-Link network-attached storage (NAS) devices, including the DNS-320L, DNS-327L, DNS-340L, and DNS-345.\nThe vulnerability resides in the processing logic of the /cgi-bin/usb_device.cgi script, specifically within the handling of the f_ups_ip argument.\nBy injecting malicious input into this parameter, a remote, unauthenticated attacker can achieve arbitrary command execution on the underlying operating system.\nThis flaw poses a severe risk, as it allows for full system compromise, unauthorized data access, persistence installation, and potentially lateral movement within the network.\nGiven that public exploit code exists, the risk is classified as critical, necessitating immediate remediation or network isolation for affected devices.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization and validation of user-supplied input provided to the f_ups_ip parameter within the /cgi-bin/usb_device.cgi script.\nThe CGI handler acts as a bridge between the web interface and the underlying system binaries. When the /cgi-bin/usb_device.cgi file processes requests, it fails to sufficiently neutralize shell metacharacters or escape input strings before passing them to system calls or command-line execution interfaces.\nAn attacker can exploit this by crafting an HTTP request containing a crafted payload injected into the f_ups_ip field. The payload typically includes shell command delimiters (such as ';', '&', or '|') followed by arbitrary system commands. Because the application logic fails to perform strict input validation (e.g., verifying the input strictly conforms to an IP address format), the shell interprets the injected commands alongside the legitimate intended operation.\nThe attack flow proceeds as follows: 1) The attacker identifies the target endpoint /cgi-bin/usb_device.cgi on the D-Link device. 2) The attacker sends a crafted POST or GET request where the f_ups_ip parameter is appended with malicious shell commands. 3) The CGI handler executes the command string via a system call with the privileges of the web server process (often root or a high-privilege service account). 4) The server processes the command and returns the output to the attacker, or executes it silently in the background.\nThis vulnerability is reachable remotely without requiring authentication, exposing the device to external threats over the internet if the management interface is not properly firewalled. The affected devices are running vulnerable firmware versions up to 20260717. Post-exploitation, an attacker gains full control over the NAS device's operating environment, enabling them to modify system configurations, access sensitive stored data, disable security logging, or leverage the device as a pivot point for further attacks on the internal network infrastructure.\nSuccessful exploitation depends solely on the ability of the remote attacker to reach the CGI interface, as no specific credentials or prior session state is required to trigger the injection vulnerability."
}