CVE-2026-85223

CriticalCVSS 9.9

Published: 03/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Summary

A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/dropbox.cgi of the CGI Handler component. Manipulating the arguments callback_url/sync_interval results in OS command injection. The attack can be initiated remotely, and the exploit has been made public.

Risk Assessment

A remote attacker can execute arbitrary commands on the device, potentially leading to device takeover and data access.

Recommendation

Restrict access to the device, apply patches or disable Dropbox functionality, and monitor network activity.

Other vulnerabilities in D-Link DNS-340L

CVE-2026-85222Critical
A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/addon_center.cgi of the Add-On Center component. Manipulating the arguments f_name/f_url/f_flag/f_login_user leads to OS command injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

Original NVD description (English source)

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.