CVE-2026-82692: D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs remote network access to the affected device and low-privileged authentication, as indicated by the PR:L attack vector. No user interaction is required.
Which inputs should be treated as dangerous?
The affected CGI endpoint is /cgi-bin/iscsi_mgr.cgi. The alias, username, password, and volume_location arguments can be manipulated to trigger operating-system command injection.
How urgent is remediation?
The issue is rated critical with a 9.9 severity score and can affect confidentiality, integrity, and availability. Public exploit information is available, increasing the likelihood of attempted exploitation.
How can I identify potentially affected systems?
Inventory D-Link DNS-340L and DNS-345 devices and determine whether their software is at or below the reported affected level of 20260717. Prioritize devices whose /cgi-bin/iscsi_mgr.cgi endpoint is remotely reachable and accessible to low-privileged accounts.