CVE-2026-82690

Name of the Vulnerable Software and Affected Versions D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717

Description A flaw in the /cgi-bin/ve mgr.cgi endpoint allows for remote OS command injection. This occurs through the manipulation of the f dev argument, enabling an attacker to execute arbitrary operating system commands on the device.

Recommendations Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Restrict access to the /cgi-bin/ve mgr.cgi endpoint to minimize the risk of exploitation.