A published proof-of-concept exploit targets an OS command injection flaw in the /cgi-bin/ve_mgr.cgi endpoint of D-Link DNS-327L and DNS-340L network storage devices, rated CVSS 9.1 (Critical).
What Is It
CVE-2026-82690 is an OS command injection vulnerability (CWE-77, CWE-78) affecting D-Link DNS-327L and DNS-340L devices up to version 20260717. The flaw resides in an unknown function within the file /cgi-bin/ve_mgr.cgi. Manipulation of the f_dev argument causes OS command injection. The attack can be carried out remotely.
VulDB, the assigning CNA, rates the issue CVSS 3.1 base score 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Under CVSS 4.0 the score is 8.5 (High), with exploit maturity listed as Proof-of-Concept.
Why It Matters
Public exploit material appears to exist, though its completeness has not been verified from the available data: VulDB lists exploit maturity as Proof-of-Concept, and the only cited artifact is a researcher writeup file hosted on a public GitHub repository. Whether that writeup contains runnable exploit code or only a technical description is not established here. Either way, it is proof-of-concept material rather than a weaponized or observed-in-use exploit, and it reduces the development effort an attacker would otherwise need. The CVSS vector indicates network-reachable exploitation with low attack complexity and no user interaction required, and a changed scope with high confidentiality, integrity, and availability impact; both to the vulnerable component and to downstream systems. High privileges are required to reach the vulnerable code path, which is the main mitigating factor.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog); no KEV entry was supplied, so there is no confirmation of active in-the-wild exploitation and no federal remediation deadline attached to it.
What's Vulnerable
- D-Link DNS-327L: versions up to 20260717 (
cpe:2.3:h:d-link:dns-327l) - D-Link DNS-340L: versions up to 20260717 (
cpe:2.3:h:d-link:dns-340l)
The affected component is the /cgi-bin/ve_mgr.cgi file, via the f_dev parameter.
Patch Status
No patch, fixed version, or vendor advisory is present in the supplied NVD record. The only vendor reference provided is D-Link's main website. The record was published 2026-08-31 and carries a vulnerability status of "Received," meaning NVD analysis is not yet complete. Because no fix is documented, restricting network access to the management interface of affected NAS devices is the only measure supportable from this data.
Sources
- NVD, CVE-2026-82690 record (published 2026-08-31, status: Received)
- VulDB, CVE entry: https://vuldb.com/cve/CVE-2026-82690
- VulDB, Vulnerability 397178: https://vuldb.com/vuln/397178
- VulDB, Threat intelligence: https://vuldb.com/vuln/397178/cti
- VulDB, Submission 894209: https://vuldb.com/submit/894209
- Researcher writeup (GitHub, dxz0069): https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-004-vulndb.md
- CISA, Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- D-Link: https://www.dlink.com/