Description

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T21:17:23.990Z",
  "pubdate": "2026-09-03T21:17:23.990Z",
  "executiveSummary": "The D-Link DNS-340L, version 1.01B04, contains a critical OS command injection vulnerability within the Add-On Center component. Specifically, the cgi-bin/addon_center.cgi script fails to properly sanitize user-supplied input provided via the f_name, f_url, f_flag, and f_login_user parameters.\nThis vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary system commands with the privileges of the web server process. Successful exploitation can lead to a complete compromise of the device, allowing for unauthorized data access, persistence installation, or further lateral movement within the network.\nThe vulnerability is particularly severe because the attack can be launched remotely without requiring prior authentication. Given the public disclosure of exploitation techniques, the risk to exposed devices is high. Organizations utilizing this hardware are at significant risk of unauthorized command execution, potentially resulting in full administrative control over the affected NAS (Network Attached Storage) system.",
  "technicalDetails": "The vulnerability resides in the /cgi-bin/addon_center.cgi component of the D-Link DNS-340L firmware version 1.01B04. The root cause is an improper neutralization of special elements used in an OS command, commonly referred to as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).\nThe application processes HTTP requests directed at the addon_center.cgi endpoint. The CGI script processes multiple input arguments: f_name, f_url, f_flag, and f_login_user. The vulnerability occurs because the backend logic passes these user-controlled parameters directly into a system() call or a similar execution shell interface without adequate validation or sanitization of shell metacharacters.\nAn attacker can exploit this by crafting a malicious HTTP request (GET or POST) containing shell operators—such as semicolons (;), backticks (`), or pipes (|)—embedded within the aforementioned parameters. For example, by injecting a payload like '; telnetd -l /bin/sh -p 9999 #', the attacker can instruct the underlying Linux shell to execute the telnet daemon, thereby opening a backdoor that allows arbitrary command execution.\nThe attack flow proceeds as follows: 1) The attacker identifies the target network-exposed DNS-340L interface; 2) The attacker submits a specially crafted HTTP request to the /cgi-bin/addon_center.cgi endpoint, populating one or more of the vulnerable parameters with shell-injection sequences; 3) The CGI application receives the input and fails to restrict dangerous characters; 4) The server-side script invokes a system shell, executing the malicious payload with the permissions of the web service user (often root or a privileged service account).\nBecause the interface does not require authentication to interact with the Add-On Center logic, the exploitation is accessible to any remote actor capable of reaching the device via the network. Post-exploitation, an attacker can gain persistent access, exfiltrate files stored on the NAS, or use the device as a pivot point for further network reconnaissance or attacks. The lack of input validation at the application layer renders the system fundamentally vulnerable to arbitrary code execution, and since no sanitization mechanism is present to filter these parameters before shell invocation, the vulnerability is trivial to trigger."
}