CVE-2026-82688

A command injection flaw (CWE-77/CWE-78) exists in the Virtual Volume handler of D-Link DNS-340L and DNS-345 NAS devices running firmware 1.01B04, 1.03B06, 1.04.B02, or 1.05b04. A remote attacker who has obtained administrator-level access to the device's web interface can inject operating-system commands through the f_sharename, f_target, or f_name parameters of /cgi-bin/virtual_vol.cgi, which are then executed on the device. Successful exploitation yields full compromise of the NAS, including reading, modifying, or destroying stored data and running arbitrary commands with the device's privileges. Any DNS-340L or DNS-345 deployment on the affected firmware is exposed, especially where the web interface is reachable from the internet, although the requirement for high privileges (reflected in the CVSS 4.0 score of 8.5) limits exploitation to attackers with admin credentials. An exploit has been publicly disclosed and may be used; the flaw is not yet in CISA KEV, and EPSS estimates a roughly 2.8% (86th percentile) probability of exploitation in the next 30 days, with no confirmed in-the-wild incidents recorded.

What to do: Inventory your environment for DNS-340L and DNS-345 units and compare firmware versions against the affected list (1.01B04, 1.03B06, 1.04.B02, 1.05b04), then apply the latest firmware D-Link publishes for these models (no fixed version is specified in the advisory). Until patched, keep the NAS administration interface off the internet or restrict it to VPN/trusted networks, since exploitation requires administrator-level credentials. Additionally, review access logs for requests to /cgi-bin/virtual_vol.cgi containing shell metacharacters in the f_sharename, f_target, or f_name parameters.