CVE-2026-82691: D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection
A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need to authenticate before exploiting this issue?
Yes. The supplied CVSS vector indicates high privileges are required (PR:H). No user interaction is required, and the attack can be performed remotely once the attacker has the necessary privileges.
How likely is this to be exploited in practice?
The exploit has been publicly disclosed and may be used. The issue is rated critical at 9.1 and can result in confidentiality, integrity, and availability impacts.
Can the available information confirm whether a particular configuration is vulnerable?
No. The affected functionality within usb_device.cgi is described as unknown, and the data does not identify a default configuration, a specific vulnerable feature state, or a detection method. Systems using the listed device models with releases up to 20260717 should be treated as potentially affected.