CVE-2026-85223

CVE-2026-85223 is an OS command injection flaw (CWE-77/CWE-78) in the CGI handler of the D-Link DNS-340L network-attached storage (NAS) device, specifically in the script /cgi-bin/dropbox.cgi. A remote attacker with low-privileged (i.e., authenticated) access, as indicated by the PR:L component of the CVSS 4.0 vector, can manipulate the callback_url or sync_interval arguments of the Dropbox-related CGI endpoint to inject and execute operating-system commands on the device. Successful exploitation yields arbitrary command execution on the NAS, and the high-impact CVSS 4.0 scores for confidentiality, integrity, and availability indicate the attacker can effectively compromise the device, its stored data, and connected services such as the linked Dropbox account. Only the DNS-340L running firmware version 1.01B04 is named as affected in the available data, and no fixed version is documented yet. A working exploit has been made public, but the issue is not yet in CISA's KEV catalog and EPSS currently assigns a 1.6% probability of exploitation within 30 days (75th percentile), so no confirmed in-the-wild compromises are documented.

What to do: Owners should check whether their DNS-340L is running firmware 1.01B04 and install patched firmware from D-Link as soon as it is released (no fixed version is specified in the available data). Until then, do not expose the device's web administration interface directly to the internet, restrict access to trusted networks or a VPN, and consider disabling the Dropbox sync feature if the CGI endpoint cannot be isolated. Ensure default or weak credentials have been changed, since exploitation requires an authenticated account.