CVE-2026-82691

Name of the Vulnerable Software and Affected Versions D-Link DNS-320L versions prior to 20260717 D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717

Description A remote OS command injection exists within the CGI Handler component. The issue occurs in the /cgi-bin/usb device.cgi endpoint when the f ups ip variable is manipulated, allowing an attacker to execute arbitrary operating system commands.

Recommendations Update D-Link DNS-320L to a version released after 20260717. Update D-Link DNS-327L to a version released after 20260717. Update D-Link DNS-340L to a version released after 20260717. Update D-Link DNS-345 to a version released after 20260717. As a temporary mitigation, restrict access to the /cgi-bin/usb device.cgi endpoint.