Cyber & AI intelligence
Wasteland.
Briefs indexed2348
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-82689 2026-08-31

CVE-2026-82689: OS Command Injection in D-Link DNS-Series NAS ISO Image Handler

"A publicly exploitable OS command injection flaw in the ISO Image Handler of four D-Link network-attached storage models allows a remote, low-privileged attacker to run arbitrary commands on the device."

A publicly exploitable OS command injection flaw in the ISO Image Handler of four D-Link network-attached storage models allows a remote, low-privileged attacker to run arbitrary commands on the device.

What Is It

CVE-2026-82689 is an OS command injection vulnerability (CWE-77, CWE-78) affecting an unknown function in /cgi-bin/isomount_mgr.cgi, part of the ISO Image Handler component on D-Link DNS-series NAS devices. Manipulation of the upIsoRootPath argument results in command injection. The attack can be executed remotely, and per the NVD record the exploit is now public and may be used.

The CVE was published 2026-08-31 by VulDB ([email protected]) and is currently in "Received" status.

Why It Matters

The vulnerability carries a base score of 9.9 (CRITICAL). The vector string published with that score, CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, is internally inconsistent; it is prefixed as CVSS v4.0 but its metrics (including the Scope metric, which v4.0 removed) are CVSS v3.1 metrics, so the version labeling in the source record should be treated as unreliable. Read on its own terms, the vector describes a network attack vector, low attack complexity, only low privileges required, and no user interaction, with Scope Changed and High impact to confidentiality, integrity, and availability. VulDB's separate CVSS v4.0 assessment rates the issue 8.6 (HIGH) with an exploit maturity of Proof-of-Concept; the CVSS v2.0 score is 9.0.

Because the affected devices are storage appliances, command injection in this component is likely to expose stored data and give an attacker substantial control over the device, though the precise reach depends on the privileges of the CGI process and the device's firmware hardening, which the available source material does not detail. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild, but a public exploit exists.

What's Vulnerable

D-Link NAS models, ISO Image Handler component, versions up to and including 20260717:

Patch Status

The supplied source material does not identify a patch, fixed firmware version, or vendor advisory for this issue. No CISA KEV entry, and therefore no KEV-mandated required action or remediation due date, was provided. Consult the vendor for current guidance.

Sources