Description

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-03T22:18:24.080Z",
  "pubdate": "2026-09-03T22:18:24.080Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the D-Link DNS-340L, specifically impacting version 1.01B04.\nThe vulnerability resides in the CGI handler component, specifically within the /cgi-bin/dropbox.cgi script, which fails to adequately sanitize user-supplied input.\nBy manipulating the callback_url or sync_interval arguments, a remote, unauthenticated attacker can execute arbitrary system commands with the privileges of the web server process.\nThis vulnerability presents a high risk to the confidentiality, integrity, and availability of the affected device, potentially allowing an attacker to gain full control of the NAS system.\nThe presence of a publicly available exploit significantly increases the risk of exploitation by malicious actors.\nAttackers can trigger this vulnerability remotely over the network, making the device highly susceptible to unauthorized access and potential lateral movement within a network environment.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located within the /cgi-bin/dropbox.cgi file, which serves as a CGI handler for the D-Link DNS-340L device.\nThe root cause of this issue is improper input validation and sanitization of the callback_url and sync_interval HTTP GET/POST parameters. The web application takes these user-controlled inputs and incorporates them into a system-level command executed by the underlying operating system.\nThe attack flow begins with a remote attacker sending a crafted HTTP request to the /cgi-bin/dropbox.cgi endpoint. The attacker injects shell metacharacters (such as backticks, semicolons, or pipes) into the vulnerable arguments. Because the backend code fails to escape these characters or validate the input against a strict allow-list, the CGI handler effectively constructs a command string that includes the attacker-supplied malicious payload.\nFor instance, if the application executes a shell command to process the sync_interval, the injection allows the shell to interpret the injected characters as command separators, leading to the execution of secondary, attacker-provided commands.\nThe component responsible for this flaw is the CGI Handler. Since the process execution context typically runs with high-level privileges on such embedded network-attached storage (NAS) devices, the resulting command injection allows for immediate arbitrary code execution. This can lead to the deployment of persistent backdoors, data exfiltration, or complete system compromise.\nThe vulnerability is remotely exploitable without requiring prior authentication. Because it is accessible via the network interface, the attack surface includes any entity capable of reaching the device's web management interface. Once the injection is successful, the attacker can leverage the shell to execute system utilities, download additional malicious binaries, or reconfigure the device settings to ensure long-term access.\nThe lack of memory protections and the common use of insecure system calls in legacy firmware exacerbate the impact of this vulnerability, making it a critical point of failure for the security posture of the D-Link DNS-340L."
}