CVE-2026-16330mediumCWE-284CWE-434

CVE-2026-16330: medium-severity vulnerability in D-Link DNS-320

D-Link DNS-320 uploadify.php unrestricted upload

Published

Follow this CVE+ Monitor DNS-320

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 1.6%
A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
D-Link · DNS-320
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — D-Link DNS-320

In the same product, most dangerous first.

CVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.5%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%CVE-2024-8132MEDIUMD-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injectionEPSS 24.4%CVE-2024-8129MEDIUMD-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injectionEPSS 23.8%CVE-2024-7922MEDIUMD-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injectionEPSS 20.3%