CVE-2026-8273mediumCWE-77CWE-78

CVE-2026-8273: medium-severity vulnerability in D-Link DNS-320

D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection

Published

Follow this CVE+ Monitor DNS-320

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 7.4%
A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
D-Link · DNS-320
Related CVEs — D-Link DNS-320

In the same product, most dangerous first.

CVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.5%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%CVE-2024-8132MEDIUMD-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injectionEPSS 24.4%CVE-2024-8129MEDIUMD-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injectionEPSS 23.8%CVE-2026-4197MEDIUMD-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectionEPSS 21.8%