CVE-2026-82692
CriticalCVSS 9.9Summary
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Risk Assessment
An attacker can execute arbitrary system commands on the device, potentially leading to full compromise and data breach.
Recommendation
Update the device firmware to the latest version if available. Restrict access to the CGI interface from trusted networks.
Other vulnerabilities in D-Link DNS-340L/DNS-345
Original NVD description (English source)
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.