CVE-2026-16327
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability was found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the /web/web_file/upload.php script. Manipulating the File argument allows remote attackers to upload arbitrary files without proper validation. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can remotely upload a malicious file (e.g., webshell) to the device, leading to full system compromise, device takeover, and potential access to the internal network of the organization.
Recommendation
Immediately disable remote access to the device management interface and apply firewall rules to block access to /web/web_file/upload.php. If no patch is available from the vendor, consider replacing the device with a supported model.
Other vulnerabilities in D-Link DNS-320
See all- CVE-2026-16447High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/jquery/uploader/multi_uploadify.php is vulnerable to unrestricted file upload via the Filedata[] argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16332High
A vulnerability was detected in D-Link DNS-320 1.0.2 in the file /mydlink/multi_uploadify.php. Manipulation of the argument Filedata[] results in unrestricted upload. The attack is remotely exploitable and the exploit is public.
- CVE-2026-16331High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/function/save_ajax.php is vulnerable to unrestricted file upload via the Malicious Handler argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16330High
A vulnerability has been found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the uploadify.php function. An attacker can remotely upload arbitrary files, potentially leading to device compromise.
- CVE-2026-16329High
A vulnerability in D-Link DNS-320 1.0.2 in the file /photo_center/php/uploadify.php allows unrestricted upload via manipulation of the Malicious Handler argument. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.