CVE-2026-82688

CriticalCVSS 9.1

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.79%

85th percentile - higher than 85% of all known CVEs

Summary

D-Link DNS-340L and DNS-345 (versions 1.01B04/1.03B06/1.04.B02/1.05b04) have a vulnerability in /cgi-bin/virtual_vol.cgi (Virtual Volume Handler). Manipulation of arguments f_sharename/f_target/f_name leads to OS command injection. Remote exploitation is possible, and the exploit has been publicly disclosed.

Risk Assessment

Risk: remote attacker can execute arbitrary commands on the device, potentially leading to full compromise and control.

Recommendation

Apply available firmware updates or disable remote access to the admin panel, and restrict device access.

Other vulnerabilities in D-Link DNS-340L/DNS-345

CVE-2026-82692Critical
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Original NVD description (English source)

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS