CVE-2026-8272 - Vulnerability Analysis
MediumCVSS: 4.7Last Updated: May 11, 2026
D-Link DNS-320 - Command Injection
Published: May 11, 2026Updated: May 11, 2026PoC AvailableRemote Exploitable
Overview
D-Link DNS-320 2.06B01 contains a command injection caused by manipulation of file management functions in /cgi-bin/webfile_mgr.cgi, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
Severity & Score
Severity: Medium
CVSS Score: 4.7
Impact
Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.
Mitigation
Update to the latest available version.
References
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20webfile_mgr.cgi%20Multiple%20OS%20Command%20Injection%20via%20File%20Operations.md
- https://vuldb.com/submit/810079
- https://vuldb.com/vuln/362569
- https://vuldb.com/vuln/362569/cti
- https://www.dlink.com/
Related Resources
Details
- CVE ID
- CVE-2026-8272
- Severity
- Medium
- CVSS Score
- 4.7
- Type
- command_injection
- Status
- confirmed
CWE
- CWE-77
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L