A critical OS command injection flaw (CVSS 9.1) in the usb_device.cgi handler of four D-Link DNS-series network storage devices could let an authenticated remote attacker execute arbitrary commands. Proof-of-concept exploit details have been published in a researcher writeup, but there are no reports of exploitation in the wild.
What Is It
CVE-2026-82691 is an OS command injection vulnerability (CWE-77 / CWE-78) in the CGI Handler component of D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices. The flaw sits in unspecified functionality of /cgi-bin/usb_device.cgi, where manipulation of the f_ups_ip argument leads to command injection. The attack can be performed remotely. VulDB assigns a CVSS 3.1 base score of 9.1 (CRITICAL) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 8.5 (HIGH) with exploit maturity rated Proof-of-Concept.
Why It Matters
Technical details of the flaw are public, which lowers the barrier to weaponization. The CVSS 3.1 vector indicates a changed scope with high confidentiality, integrity, and availability impact; command injection on a NAS appliance would mean access to stored data and a foothold on the network segment the device sits in. Attack complexity is low and no user interaction is required. The significant mitigating factor is that high privileges are required (PR:H), so an attacker needs existing authenticated access to the device's management interface; this is not an unauthenticated pre-auth path.
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this writing, and neither NVD nor VulDB reports observed in-the-wild activity. Active exploitation is therefore unconfirmed.
What's Vulnerable
Affected D-Link products, all through version 20260717:
- DNS-320L
- DNS-327L
- DNS-340L
- DNS-345
The affected component is the CGI Handler, specifically the file /cgi-bin/usb_device.cgi and the f_ups_ip parameter.
Patch Status
The NVD entry for CVE-2026-82691 lists no patch, fixed version, or vendor advisory, and D-Link has not published a security bulletin for this issue at the time of writing. The CVE was published 2026-08-31 and carries an NVD status of "Received," meaning NVD analysis is not yet complete and the record may change as enrichment proceeds. Because the CVE is not in the CISA KEV catalog, no federal remediation deadline applies.
The support and firmware status of the four affected models is not stated in the NVD or VulDB records for this CVE, so whether a fix is planned is unknown. Operators should confirm current support status and firmware availability with D-Link directly, and in the meantime restrict management-interface access to trusted networks and ensure these devices are not reachable from the internet.
Sources
- NVD, CVE-2026-82691: https://nvd.nist.gov/vuln/detail/CVE-2026-82691
- VulDB, CVE-2026-82691: https://vuldb.com/cve/CVE-2026-82691
- VulDB, Vulnerability 397179: https://vuldb.com/vuln/397179
- VulDB, CTI Report 397179: https://vuldb.com/vuln/397179/cti
- VulDB, Submission 894210: https://vuldb.com/submit/894210
- Researcher writeup (DLINK-CMD-005): https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-005-vulndb.md
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- D-Link: https://www.dlink.com/