CVE-2026-82689: OS Command Injection in D-Link DNS-320L

This vulnerability involves an OS command injection in an unspecified function within the /cgi-bin/isomount_mgr.cgi file of the ISO Image Handler component on affected D-Link NAS devices. By manipulating the upIsoRootPath parameter, an attacker can remotely execute arbitrary operating system commands. The affected devices include D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 running firmware versions up to 20260717. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, there is no evidence of exploitation in the wild. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects core device functionality related to ISO image handling, which could be leveraged to gain unauthorized control over the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices, especially to the /cgi-bin/isomount_mgr.cgi endpoint, and monitor for suspicious activity. Avoid exposing these devices directly to untrusted networks.