CVE-2026-16329
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in D-Link DNS-320 1.0.2 in the file /photo_center/php/uploadify.php allows unrestricted upload via manipulation of the Malicious Handler argument. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
A remote attacker could upload malicious files to the device, potentially leading to device compromise or further network intrusion.
Recommendation
Apply available patches from the vendor or restrict access to the device from trusted networks.
Other vulnerabilities in D-Link DNS-320
See all- CVE-2026-16447High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/jquery/uploader/multi_uploadify.php is vulnerable to unrestricted file upload via the Filedata[] argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16332High
A vulnerability was detected in D-Link DNS-320 1.0.2 in the file /mydlink/multi_uploadify.php. Manipulation of the argument Filedata[] results in unrestricted upload. The attack is remotely exploitable and the exploit is public.
- CVE-2026-16331High
In D-Link DNS-320 version 1.0.2, an unknown function in /web/function/save_ajax.php is vulnerable to unrestricted file upload via the Malicious Handler argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-16330High
A vulnerability has been found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the uploadify.php function. An attacker can remotely upload arbitrary files, potentially leading to device compromise.
- CVE-2026-16327High
A vulnerability was found in D-Link DNS-320 version 1.0.2, involving unrestricted file upload in the /web/web_file/upload.php script. Manipulating the File argument allows remote attackers to upload arbitrary files without proper validation. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used.