CVE-2026-82688: OS Command Injection in D-Link DNS-340L

This vulnerability in D-Link DNS-340L and DNS-345 firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04 involves an OS command injection in the Virtual Volume Handler component, specifically in the /cgi-bin/virtual_vol.cgi file. By manipulating the arguments f_sharename, f_target, or f_name, an attacker can inject and execute arbitrary operating system commands remotely. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. While the exploit has been publicly disclosed, no official fix or patch is documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full system compromise. This can result in unauthorized control over the device, data theft, or disruption of network services. The critical CVSS score reflects the high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling affected services or restricting network access to the vulnerable CGI endpoint to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.