CVE-2026-82689criticalCWE-77CWE-78

CVE-2026-82689: fallo crítico en D-Link DNS-320L

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

Publicada el

Seguir esta CVE+ Monitorear DNS-340L+ Monitorear DNS-327L

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 9.4epss 3.3%
A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Productos afectados
D-Link · DNS-320LD-Link · DNS-327LD-Link · DNS-340LD-Link · DNS-345
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — D-Link DNS-320L

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3273HIGHD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injectionEPSS 100.0%KEVCVE-2024-3272CRITICALD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsEPSS 98.1%KEVCVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.5%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-3274MEDIUMD-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosureEPSS 33.5%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%