CVE-2026-85222

CriticalCVSS 9.1

Published: 03/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Summary

A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/addon_center.cgi of the Add-On Center component. Manipulating the arguments f_name/f_url/f_flag/f_login_user leads to OS command injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

Risk Assessment

A remote attacker can execute arbitrary commands on the device, potentially leading to full device compromise and data integrity violation.

Recommendation

Restrict access to the device, apply patches or disable the add-on center, and monitor logs.

Other vulnerabilities in D-Link DNS-340L

CVE-2026-85223Critical
A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/dropbox.cgi of the CGI Handler component. Manipulating the arguments callback_url/sync_interval results in OS command injection. The attack can be initiated remotely, and the exploit has been made public.

Original NVD description (English source)

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.