Description

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T13:18:29.387Z",
  "pubdate": "2026-08-31T13:18:29.387Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in D-Link DNS-340L and DNS-345 devices, affecting firmware versions up to 20260717. The vulnerability resides within the /cgi-bin/iscsi_mgr.cgi script, which fails to adequately sanitize user-supplied input.\nBy manipulating specific parameters—namely alias, username, password, or volume_location—an unauthenticated remote attacker can inject arbitrary shell commands that execute with the privileges of the web server process.\nThis vulnerability poses a significant risk to the integrity, confidentiality, and availability of the affected network-attached storage (NAS) devices. Successful exploitation grants the attacker full control over the underlying operating system, potentially leading to total system compromise, data exfiltration, or the installation of persistent malicious backdoors.\nGiven that public exploit code exists, the risk level is high. The attack requires network reachability to the device’s administrative interface; however, it does not explicitly require prior authentication to trigger the command execution, making it a highly dangerous vector for internet-facing or improperly segmented internal storage devices.",
  "technicalDetails": "The vulnerability is a classic OS command injection flaw located in the /cgi-bin/iscsi_mgr.cgi component of the D-Link DNS-340L and DNS-345 storage systems. The root cause is the improper handling of HTTP POST or GET request parameters passed to the CGI script. The application takes input from the alias, username, password, or volume_location arguments and passes these strings directly into system-level execution functions, such as system() or popen(), without sufficient validation, neutralization, or escaping of shell metacharacters.\nThe attack flow begins when an attacker sends a crafted HTTP request to the /cgi-bin/iscsi_mgr.cgi endpoint. By embedding shell metacharacters (e.g., semicolon ';', pipe '|', or backticks '`') within the vulnerable parameters, the attacker breaks out of the intended command context.\nFor example, if the application constructs a shell command such as 'storage_cmd [parameter_value]', injecting a payload like '; cat /etc/shadow #' forces the underlying Linux shell to terminate the intended command and execute the secondary injected command. Because these CGI scripts typically run with high privileges (often root or a service account with administrative rights), the injected commands execute with the same level of authority.\nThe exploitation path does not require authentication, allowing any remote user with network access to the web management interface to trigger the vulnerability. The payload behavior is limited only by the privileges of the web user and the available binaries on the NAS firmware; common post-exploitation activities include downloading external binaries via wget or curl, modifying configuration files to disable security controls, creating persistent administrative users, or utilizing the device as a pivot point to move laterally within the internal network.\nThe vulnerability is persistent across the documented versions up to 20260717. The failure to sanitize input at the entry point of the CGI handler confirms a lack of secure coding practices in the input validation logic. Because the device is an NAS, the compromise of the operating system provides the attacker with direct access to all stored data volumes, further escalating the impact of the initial command injection."
}