A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. (CVE-2026-82692)

CVE-2026-82692 is an OS command injection vulnerability affecting D-Link DNS-340L and DNS-345 devices up to version 20260717. The vulnerability resides in the /cgi-bin/iscsi_mgr.cgi CGI script, where manipulation of certain parameters (alias, username, password, volume_location) allows an attacker to execute arbitrary operating system commands remotely. The CVSS v3.1 base score is 9.9, indicating critical impact on confidentiality, integrity, and availability. Exploit code has been publicly disclosed, increasing the risk of exploitation. No vendor advisory or patch information is available in the provided data.

Successful exploitation allows remote attackers with low privileges to execute arbitrary OS commands on affected devices, potentially leading to full system compromise, data theft, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level as reflected by the CVSS score of 9.9. Public exploit availability increases the likelihood of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected devices, especially to the /cgi-bin/iscsi_mgr.cgi endpoint, and monitor for suspicious activity related to this vulnerability.