A vulnerability has been found in D-Link DNS-340L 1.01B04. (CVE-2026-85222)

CVE-2026-85222 is an OS command injection vulnerability affecting the Add-On Center component of D-Link DNS-340L firmware version 1.01B04. The vulnerability arises from improper handling of input parameters (f_name, f_url, f_flag, f_login_user) in the /cgi-bin/addon_center.cgi endpoint, allowing remote attackers with high privileges to execute arbitrary operating system commands. The vulnerability is remotely exploitable without user interaction and has a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The exploit code has been publicly disclosed, increasing the risk of potential attacks. No official patch or fix has been documented in the provided data.

Successful exploitation of this vulnerability can lead to complete compromise of the affected device, including full control over the operating system, resulting in confidentiality, integrity, and availability impacts. Remote attackers with high privileges can execute arbitrary OS commands, potentially leading to device takeover or disruption of services. The vulnerability affects critical security properties and poses a high risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces to trusted users only. Monitor for unusual activity related to the /cgi-bin/addon_center.cgi endpoint and consider disabling or restricting the Add-On Center functionality if feasible. Follow vendor communications closely for updates on patches or official mitigations.