CVE-2026-82692

Name of the Vulnerable Software and Affected Versions D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717

Description Remote OS command injection is possible through the manipulation of the alias, username, password, or volume location arguments within the '/cgi-bin/iscsi mgr.cgi' endpoint. This allows an attacker to execute arbitrary operating system commands on the device remotely.

Recommendations Update D-Link DNS-340L to version 20260717 or later. Update D-Link DNS-345 to version 20260717 or later. Restrict access to the '/cgi-bin/iscsi mgr.cgi' endpoint to minimize the risk of exploitation.