Description

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T22:18:24.260Z",
  "pubdate": "2026-09-03T22:18:24.260Z",
  "executiveSummary": "The D-Link DNS-320 ShareCenter, specifically version 2.06B01, contains a critical OS command injection vulnerability within the File Sharing component.\nThe vulnerability resides in the /cgi/file_sharing.cgi script, which fails to properly sanitize user-supplied input provided via the fileurl argument.\nThis flaw allows a remote, unauthenticated attacker to inject arbitrary shell commands that are executed with the privileges of the web server process.\nThe successful exploitation of this vulnerability leads to complete system compromise, enabling the attacker to execute unauthorized code, manipulate sensitive data, or establish persistent backdoors.\nGiven that the exploit code has been publicly disclosed, the risk of active exploitation is significant. Systems exposed to the public network are at high risk, as no complex interaction or prior authentication is required to trigger the injection.",
  "technicalDetails": "The vulnerability manifests in /cgi/file_sharing.cgi within the File Sharing component of the D-Link DNS-320 firmware version 2.06B01. The core issue is an improper validation and sanitization of the 'fileurl' parameter passed to the CGI interface.\nWhen a request is submitted to /cgi/file_sharing.cgi, the backend binary or script process parses the 'fileurl' parameter. Due to a lack of robust input filtering or the use of insecure system execution functions—such as system(), popen(), or exec()—the application fails to distinguish between legitimate URL input and malicious shell metacharacters.\nAn attacker can exploit this by crafting a specially formed HTTP request where the 'fileurl' parameter contains command separators (e.g., ';', '&', '&&', or '|'). By appending these metacharacters followed by arbitrary system commands, an attacker forces the underlying operating system to interpret and execute the injected payload.\nThe attack flow proceeds as follows: First, the attacker identifies the target endpoint /cgi/file_sharing.cgi. Second, the attacker crafts a malicious HTTP GET or POST request containing the payload within the 'fileurl' argument. Third, the application server receives the request and passes the tainted string directly to the system shell. Fourth, the shell executes the injected command with the privileges of the web service account. Finally, the server processes the request as part of the intended file sharing operation, often concealing the command execution behind legitimate application logic.\nBecause the command execution occurs within the context of the device's web server, the impact is severe. An attacker can gain shell access, install malware, exfiltrate data from the NAS storage volumes, or use the device as a pivot point for further lateral movement within the internal network. The vulnerability is remotely exploitable, requiring no interaction from an authenticated user, and can be triggered over any network interface that has access to the device's web administration panel."
}