The vulnerability CVE-2026-16447 affects D-Link DNS-320 version 1.0.2 and is caused by improper validation of the Filedata[] argument in the multi_uploadify.php file. This flaw permits unrestricted file uploads, enabling remote attackers to potentially upload malicious files to the device. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. No vendor advisory or patch information is currently provided, and the exploit details have been publicly disclosed.

Successful exploitation allows remote attackers to upload arbitrary files to the affected device, which may lead to further compromise depending on the file type and server configuration. The vulnerability does not require authentication or user interaction, increasing its risk. However, the exact post-upload impact is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected upload endpoint and monitor for suspicious upload activity. Consider network-level controls to limit exposure of the device to untrusted networks.