CVE-2026-85223: D-Link DNS-340L CGI dropbox.cgi os command injection

Published Sep 3, 2026

Updated

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Affected Software

2 affected components

D-Link DNS-340L=1.01B04

D-Link DNS-340L/cgi-bin/dropbox.cgi

Event History

Sep 3, 2026

CVE Published

via MITRE·09:15 PM

Data Sourced

via MITRE·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be initiated remotely, but the published vector specifies low privileges (PR:L). An attacker therefore needs access to the affected CGI handler and a low-privileged authenticated context.

Which inputs are implicated in the command injection?

The vulnerable CGI endpoint is /cgi-bin/dropbox.cgi. Manipulation of the callback_url or sync_interval arguments can result in OS command injection.

How urgent is remediation?

This is rated critical with a 9.9 severity score, and the exploit has been made public. Treat systems running D-Link DNS-340L 1.01B04 as high-priority for remediation or exposure reduction.