A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. (CVE-2026-82689)

CVE-2026-82689 is a remote OS command injection vulnerability in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices up to version 20260717. The vulnerability resides in the ISO Image Handler component's /cgi-bin/isomount_mgr.cgi file, where improper sanitization of the upIsoRootPath argument allows an attacker with low privileges to execute arbitrary OS commands remotely without user interaction. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). Exploit code is publicly available, increasing the risk of exploitation. The CVSS v3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Successful exploitation allows remote attackers with low privileges to execute arbitrary operating system commands on affected devices, potentially leading to full system compromise, including complete loss of confidentiality, integrity, and availability of the device and its data. The vulnerability affects critical components of the device's firmware and can be exploited remotely without user interaction.

No official patch or remediation is currently confirmed for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. Until a fix is available, restricting network access to the affected devices, especially to the /cgi-bin/isomount_mgr.cgi endpoint, and applying network-level protections such as firewall rules may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.