CVE-2026-16447 describes a vulnerability in D-Link DNS-320 1.0.2 where manipulation of the Filedata[] argument in /web/jquery/uploader/multi_uploadify.php leads to unrestricted file upload capability. This allows an unauthenticated remote attacker to upload arbitrary files to the device. The vulnerability is classified under CWE-284 (Improper Access Control). Exploit details have been publicly disclosed, but no patch or fix has been provided by the vendor as of the information available.

The vulnerability allows remote attackers to upload files without restriction, potentially leading to unauthorized code execution or system compromise. Since the upload is unrestricted and requires no authentication, the attack surface is broad. However, the exact impact depends on the nature of the uploaded files and the device's handling of them. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to file uploads. Consider disabling or restricting the vulnerable upload functionality if possible.