CVE-2026-82691

CVE-2026-82691 is an operating system command injection flaw (CWE-77/CWE-78) in the CGI handler of D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 network-attached storage devices, triggered through the f_ups_ip argument of /cgi-bin/usb_device.cgi. A remote attacker who can reach the device's web interface and, per the CVSS 4.0 scoring (PR:H), holds high-privilege (admin) credentials can send a crafted value in that argument to execute arbitrary operating system commands on the NAS. Successful exploitation yields high impact on confidentiality, integrity and availability of the device and potentially on subsequent systems, effectively giving the attacker control of the NAS. All four models running firmware up to and including the 20260717 (2026-07-17) build are affected. A public exploit exists and the flaw may be used, but it is not in CISA KEV and there is no confirmed widespread in-the-wild campaign yet; EPSS estimates a 2.1% (81st percentile) probability of exploitation in the next 30 days.

What to do: Check the firmware build on any DNS-320L, DNS-327L, DNS-340L or DNS-345 and, if it is dated 20260717 or earlier, monitor D-Link's support/download pages for updated firmware, as the advisory names no fixed release. Until a patch is available, keep the NAS web administration interface off the public internet (restrict to LAN/VPN with firewall rules) and ensure strong, unique admin credentials, since the CVSS scoring indicates the attack requires high-privilege access. Verify that any remote-access or UPnP-forwarded rules exposing the NAS web UI have been disabled or limited to trusted sources.