CVE-2026-82689

Name of the Vulnerable Software and Affected Versions D-Link DNS-320L versions prior to 20260717 D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717

Description An OS command injection flaw exists in the ISO Image Handler component. A remote attacker can exploit this by manipulating the upIsoRootPath variable within the '/cgi-bin/isomount mgr.cgi' endpoint, allowing for the execution of arbitrary operating system commands.

Recommendations Update D-Link DNS-320L to a version released after 20260717. Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Update D-Link DNS-345 to a version released after 20260717. As a temporary mitigation, restrict access to the '/cgi-bin/isomount mgr.cgi' endpoint.