CVE-2026-16447

Deferred Deferred - Pending Action

Unrestricted File Upload in D-Link DNS-320

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: VulDB

Description

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-07-22

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-16447

EUVD

EUVD-2026-46258

Affected Vendors & Products

Vendor	Product	Version / Range
d-link	dns-320	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability affects the D-Link DNS-320 device version 1.0.2. It involves a flaw in the file /web/jquery/uploader/multi_uploadify.php where the argument Filedata[] can be manipulated to allow unrestricted file uploads. This means attackers can upload malicious files remotely without proper restrictions.

Detection Guidance

To detect this vulnerability, check for unauthorized file uploads in the /web/jquery/uploader/multi_uploadify.php path on D-Link DNS-320 devices. Inspect network traffic for suspicious POST requests to this endpoint with the Filedata[] parameter. Look for unexpected files in upload directories.

Impact Analysis

An attacker could exploit this to upload malicious files to your device, potentially leading to remote code execution, data theft, or unauthorized access to your network. This could compromise the integrity and security of your system and connected data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update the D-Link DNS-320 firmware to the latest version. Disable or restrict access to the /web/jquery/uploader/multi_uploadify.php endpoint if possible. Implement network-level controls to block unauthorized upload attempts. Monitor for signs of exploitation or unauthorized file uploads.

Hi! I’m here to help you understand CVE-2026-16447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70