Actively exploited in the wild
D-Link DNS-320 Remote Code Execution Vulnerability
D-Link - DNS-320 Storage Device · Listed in the CISA KEV since 2022-04-15. This indicates confirmed attacks in production environments.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2019-16057
CriticalCVSS 9.8KEVSummary
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. An attacker can exploit this flaw to execute arbitrary commands on the system.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, leading to full control compromise. This could result in data theft, configuration modification, or using the device for further attacks.
Recommendation
Update the firmware of the D-Link DNS-320 device to the latest version. If no update is available, restrict access to the management interface or disable the device.
Other vulnerabilities in D-Link DNS-320
See all- CVE-2020-25506CriticalActively exploited
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
- CVE-2026-16447High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/jquery/uploader/multi_uploadify.php is vulnerable to unrestricted file upload via the Filedata[] argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16332High
A vulnerability was detected in D-Link DNS-320 1.0.2 in the file /mydlink/multi_uploadify.php. Manipulation of the argument Filedata[] results in unrestricted upload. The attack is remotely exploitable and the exploit is public.
- CVE-2026-16331High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/function/save_ajax.php is vulnerable to unrestricted file upload via the Malicious Handler argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16330High
A vulnerability has been found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the uploadify.php function. An attacker can remotely upload arbitrary files, potentially leading to device compromise.
- CVE-2026-16329High
A vulnerability in D-Link DNS-320 1.0.2 in the file /photo_center/php/uploadify.php allows unrestricted upload via manipulation of the Malicious Handler argument. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-16327High
A vulnerability was found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the /web/web_file/upload.php script. Manipulating the File argument allows remote attackers to upload arbitrary files without proper validation. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.