CVE-2026-16330
Received Received - Intake

Unrestricted File Upload in D-Link DNS-320

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulDB

Description
A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16330
EUVD
EUVD-2026-46137

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dns-320 1.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in D-Link DNS-320 version 1.0.2. It involves an unrestricted file upload flaw in the /web/jquery/uploader/uploadify.php component. Attackers can exploit this by manipulating a URL argument to upload malicious files remotely.

Detection Guidance

This vulnerability involves unrestricted file uploads via /web/jquery/uploader/uploadify.php in D-Link DNS-320 1.0.2. To detect it, check for unexpected files in the upload directory, monitor network traffic for upload requests to unknown domains, and inspect logs for suspicious activity related to the file path or external links.

Impact Analysis

An attacker could upload malicious files to the device, potentially gaining control over it. This could lead to data theft, unauthorized access, or further network compromise if the device is connected to other systems.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, leading to potential breaches of GDPR or HIPAA. Organizations may face penalties if they fail to protect data adequately.

Mitigation Strategies

Immediately update the D-Link DNS-320 firmware to the latest version to address the unrestricted file upload vulnerability in /web/jquery/uploader/uploadify.php. Disable or restrict access to the vulnerable uploadify.php endpoint if an update is not immediately available. Monitor network traffic for suspicious uploads to untrusted domains like the one mentioned in the CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart