Actively exploited in the wild
D-Link DNS-320 Device Command Injection Vulnerability
D-Link - DNS-320 Device · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-25506
CriticalCVSS 9.8KEVSummary
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
Risk Assessment
A network attacker with access to the device interface can take control of the system and execute arbitrary commands, resulting in full device compromise.
Recommendation
Update the firmware to the latest vendor release or decommission the device if no fix is available; restrict access to the management interface.
Other vulnerabilities in D-Link DNS-320
See all- CVE-2019-16057CriticalActively exploited
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. An attacker can exploit this flaw to execute arbitrary commands on the system.
- CVE-2026-16447High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/jquery/uploader/multi_uploadify.php is vulnerable to unrestricted file upload via the Filedata[] argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16332High
A vulnerability was detected in D-Link DNS-320 1.0.2 in the file /mydlink/multi_uploadify.php. Manipulation of the argument Filedata[] results in unrestricted upload. The attack is remotely exploitable and the exploit is public.
- CVE-2026-16331High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/function/save_ajax.php is vulnerable to unrestricted file upload via the Malicious Handler argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16330High
A vulnerability has been found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the uploadify.php function. An attacker can remotely upload arbitrary files, potentially leading to device compromise.
- CVE-2026-16329High
A vulnerability in D-Link DNS-320 1.0.2 in the file /photo_center/php/uploadify.php allows unrestricted upload via manipulation of the Malicious Handler argument. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-16327High
A vulnerability was found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the /web/web_file/upload.php script. Manipulating the File argument allows remote attackers to upload arbitrary files without proper validation. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.