CVE-2026-16448

Name of the Vulnerable Software and Affected Versions D-Link DNS-120 versions prior to 20260205 D-Link DNR-202L versions prior to 20260205 D-Link DNS-315L versions prior to 20260205 D-Link DNS-320 versions prior to 20260205 D-Link DNS-320L versions prior to 20260205 D-Link DNS-320LW versions prior to 20260205 D-Link DNS-321 versions prior to 20260205 D-Link DNR-322L versions prior to 20260205 D-Link DNS-323 versions prior to 20260205 D-Link DNS-325 versions prior to 20260205 D-Link DNS-326 versions prior to 20260205 D-Link DNS-327L versions prior to 20260205 D-Link DNR-326 versions prior to 20260205 D-Link DNS-340L versions prior to 20260205 D-Link DNS-343 versions prior to 20260205 D-Link DNS-345 versions prior to 20260205 D-Link DNS-726-4 versions prior to 20260205 D-Link DNS-1100-4 versions prior to 20260205 D-Link DNS-1200-05 versions prior to 20260205 D-Link DNS-1550-04 versions prior to 20260205

Description Remote command injection is possible due to insufficient input validation in the cgi check rsync rw() function within the /cgi-bin/remote backup.cgi endpoint. An attacker can execute arbitrary commands remotely by manipulating the ip variable.

Recommendations Update DNS-120 to version 20260205 or later. Update DNR-202L to version 20260205 or later. Update DNS-315L to version 20260205 or later. Update DNS-320 to version 20260205 or later. Update DNS-320L to version 20260205 or later. Update DNS-320LW to version 20260205 or later. Update DNS-321 to version 20260205 or later. Update DNR-322L to version 20260205 or later. Update DNS-323 to version 20260205 or later. Update DNS-325 to version 20260205 or later. Update DNS-326 to version 20260205 or later. Update DNS-327L to version 20260205 or later. Update DNR-326 to version 20260205 or later. Update DNS-340L to version 20260205 or later. Update DNS-343 to version 20260205 or later. Update DNS-345 to version 20260205 or later. Update DNS-726-4 to version 20260205 or later. Update DNS-1100-4 to version 20260205 or later. Update DNS-1200-05 to version 20260205 or later. Update DNS-1550-04 to version 20260205 or later. As a temporary workaround, restrict access to the /cgi-bin/remote backup.cgi endpoint.