CVE-2026-8273

A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.

Score

CVSS 3.1 7.2 High

Status

Analyzed - cna@vuldb.com

Published

2026-05-11

Last modified

2026-10-26

Weaknesses

CWE-77, CWE-78

Affected products

• Dns-320 (D-link)
• Dns-320 Firmware (Dlink)

References

• https://vuldb.com/vuln/362570
• https://vuldb.com/vuln/362570/cti
• https://vuldb.com/submit/810082
• https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20%20system_…
• https://www.dlink.com/