CVE-2026-8272

MEDIUM

D-Link DNS-320 webfile_mgr.cgi chown os command injection

Title source: cna

Description

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-362569 | D-Link DNS-320 webfile_mgr.cgi chown os command injection

https://vuldb.com/vuln/362569

Signature, Permissions Required signature permissions-required

VDB-362569 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/362569/cti

Third Party Advisory third-party-advisory

Submit #810079 | D-Link Corporation DNS-320 ShareCenter NAS (Rev.A) Firmware 2.06B01 HOTFIX CWE-78: OS Command Injection

https://vuldb.com/submit/810079

Exploit exploit

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20webfile_mgr.cgi%20Multiple%20OS%20Command%20Injection%20via%20File%20Operations.md

View Exploit ZIP pw:eip

Product product

https://www.dlink.com/

Scores

CVSS v3 4.7

EPSS 0.0005

EPSS Percentile 15.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-77 CWE-78

Status published

Products (2)

D-Link/DNS-320 2.06B01

dlink/dns-320_firmware 2.06b01

Published May 11, 2026

Tracked Since May 11, 2026