St4R0001

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320L versions prior to 20260717 D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717 **Description** A remote OS command injection exists within the CGI Handler component. The issue occurs in the `/cgi-bin/usb device.cgi` endpoint when the `f ups ip` variable is manipulated, allowing an attacker to execute arbitrary operating system commands. **Recommendations** Update D-Link DNS-320L to a version released after 20260717. Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Update D-Link DNS-345 to a version released after 20260717. As a temporary mitigation, restrict access to the `/cgi-bin/usb device.cgi` endpoint.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-340L version 1.01B04 D-Link DNS-340L version 1.03B06 D-Link DNS-340L version 1.04.B02 D-Link DNS-340L version 1.05b04 D-Link DNS-345 version 1.01B04 D-Link DNS-345 version 1.03B06 D-Link DNS-345 version 1.04.B02 D-Link DNS-345 version 1.05b04 **Description** An OS command injection flaw exists in the Virtual Volume Handler component. The issue occurs when the `/cgi-bin/virtual vol.cgi` endpoint fails to properly sanitize the `f sharename`, `f target`, and `f name` arguments, allowing a remote attacker to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/cgi-bin/virtual vol.cgi` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320L versions prior to 20260717 D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717 **Description** An OS command injection flaw exists in the ISO Image Handler component. A remote attacker can exploit this by manipulating the `upIsoRootPath` variable within the '/cgi-bin/isomount mgr.cgi' endpoint, allowing for the execution of arbitrary operating system commands. **Recommendations** Update D-Link DNS-320L to a version released after 20260717. Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Update D-Link DNS-345 to a version released after 20260717. As a temporary mitigation, restrict access to the '/cgi-bin/isomount mgr.cgi' endpoint.

**Name of the Vulnerable Software and Affected Versions** D-Link DSM-G600 version 1.01 **Description** A weakness in the Multipart Handler component allows a remote attacker to perform an out-of-bounds write. This occurs through the manipulation of the `/load file.cgi` endpoint. An out-of-bounds write is a memory corruption error that happens when data is written outside the boundaries of a pre-allocated buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/load file.cgi` endpoint to minimize the risk of exploitation.

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback url/sync interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717 **Description** Remote OS command injection is possible through the manipulation of the `alias`, `username`, `password`, or `volume location` arguments within the '/cgi-bin/iscsi mgr.cgi' endpoint. This allows an attacker to execute arbitrary operating system commands on the device remotely. **Recommendations** Update D-Link DNS-340L to version 20260717 or later. Update D-Link DNS-345 to version 20260717 or later. Restrict access to the '/cgi-bin/iscsi mgr.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 **Description** A flaw in the `/cgi-bin/ve mgr.cgi` endpoint allows for remote OS command injection. This occurs through the manipulation of the `f dev` argument, enabling an attacker to execute arbitrary operating system commands on the device. **Recommendations** Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Restrict access to the `/cgi-bin/ve mgr.cgi` endpoint to minimize the risk of exploitation.