CVE-2026-82688
Received Received - Intake

OS Command Injection in D-Link DNS-340L/DNS-345

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82688
EUVD
EUVD-2026-68468

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
d-link dns-340l 1.01b04
d-link dns-345 1.03b06
d-link dns-345 1.04.b02
d-link dns-345 1.05b04

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82688 is an OS command injection vulnerability in D-Link DNS-340L and DNS-345 ShareCenter NAS devices. It exists in the virtual_vol.cgi CGI handler, which executes shell commands using unsanitized HTTP POST parameters like f_sharename, f_target, and f_name. Attackers can inject arbitrary commands via crafted POST requests to /cgi-bin/virtual_vol.cgi, leading to remote code execution on the device.

Detection Guidance

To detect this vulnerability, check if your D-Link DNS-340L or DNS-345 device is running affected firmware versions (1.01B04 for DNS-340L or 1.03B06/1.04.B02/1.05b04 for DNS-345). Test for command injection by sending crafted POST requests to /cgi-bin/virtual_vol.cgi with parameters like f_sharename, f_target, or f_name containing shell commands (e.g., '; touch /tmp/vulnerable'). Monitor for unexpected file creation or system behavior.

  • Use curl to send a test POST request: curl -X POST -d 'f_sharename=test;id' http://<device_ip>/cgi-bin/virtual_vol.cgi. If the response includes command output (e.g., uid=), the device is vulnerable.
Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary shell commands on the device. Potential impacts include file modifications, persistent access, data theft, network pivoting, or service disruption. Exploitation can lead to unauthorized control of the NAS device and compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access, data theft, or modification of sensitive information stored on the affected D-Link devices. For GDPR, this may result in violations of data integrity and confidentiality, potentially leading to regulatory penalties. For HIPAA, unauthorized access to protected health information could compromise compliance with security requirements.

Mitigation Strategies

Immediately disconnect the affected D-Link device from your network to prevent exploitation. Check for firmware updates from D-Link addressing this issue. If no patch is available, restrict access to the device via network segmentation or firewall rules. Disable the Virtual Volume feature if unused. Monitor logs for suspicious POST requests to /cgi-bin/virtual_vol.cgi.

  • Apply strict input validation for HTTP POST parameters. Replace system() calls with safer alternatives like execve() in the firmware code. Enforce strong authentication for Virtual Volume management actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart