CVE-2026-85224

CVE-2026-85224 is an OS command injection flaw in the File Sharing component of the D-Link DNS-320 ShareCenter network-attached storage device, affecting firmware version 2.06B01. The flaw resides in the /cgi/file_sharing.cgi script, where manipulation of the fileurl argument allows attacker-supplied input to be executed as operating-system commands; the attack can be launched remotely, and the CVSS 4.0 vector's high privileges requirement (PR:H) indicates the attacker needs privileged access to the device, most likely an authenticated administrative session. Successful exploitation yields arbitrary command execution on the NAS with high impact to confidentiality, integrity, and availability, effectively enabling full compromise of the device and the data stored on it. Only owners of the D-Link DNS-320 ShareCenter, a legacy consumer NAS, are implicated by the advisory; no other D-Link products are named. The exploit has been publicly disclosed and may be used, but the flaw is not yet in CISA's KEV catalog and EPSS currently estimates only about a 2.2% probability of exploitation within the next 30 days.

What to do: Check D-Link's support site for an updated DNS-320 firmware addressing CVE-2026-85224; note the product is end-of-life, so a patch may be limited or unavailable, in which case stop exposing the device's web interface to the internet. As an interim mitigation, restrict or block inbound access to /cgi/file_sharing.cgi and review logs for requests carrying command-like content in the fileurl parameter.