A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. (CVE-2026-82688)

CVE-2026-82688 is an OS command injection vulnerability in D-Link DNS-340L and DNS-345 devices affecting firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The vulnerability arises from improper input validation of the f_sharename, f_target, and f_name arguments in the /cgi-bin/virtual_vol.cgi endpoint of the Virtual Volume Handler component. Remote attackers with high privileges can exploit this flaw to execute arbitrary OS commands, potentially compromising the device's confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Public exploit code has been disclosed, but no active exploitation in the wild has been confirmed. No official patch or vendor advisory is currently available.

Successful exploitation allows remote attackers with high privileges to execute arbitrary operating system commands on affected D-Link DNS-340L and DNS-345 devices. This can lead to full compromise of the device, including unauthorized access to sensitive data, disruption of service, and potential further network compromise. The vulnerability impacts confidentiality, integrity, and availability with a high severity rating (CVSS 9.1).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected devices' management interfaces to trusted networks and users with high privileges. Monitor for unusual activity related to the /cgi-bin/virtual_vol.cgi endpoint. Avoid exposing these devices directly to untrusted networks.