CVE-2026-85222: D-Link DNS-340L Add-On Center addon_center.cgi os command injection
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The published severity vector indicates high privileges are required. Exploitation is remote and does not require user interaction.
Which inputs are implicated in the command injection?
The affected Add-On Center CGI endpoint accepts the f_name, f_url, f_flag, and f_login_user arguments. Manipulation of these arguments can lead to operating-system command injection.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.