CVE-2026-82691: OS Command Injection in D-Link DNS-320L

This vulnerability involves an OS command injection flaw in the D-Link DNS-320L series and related models up to the 20260717 firmware. The flaw is located in the CGI Handler's /cgi-bin/usb_device.cgi endpoint, where improper sanitization of the f_ups_ip parameter allows remote attackers to inject and execute arbitrary operating system commands. The vulnerability can be exploited remotely without user interaction and requires high privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available, and the affected versions are not explicitly enumerated beyond the build date reference.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full system compromise. This can result in unauthorized access, data theft, service disruption, or further network penetration. The critical CVSS score reflects the high severity and broad impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote access to the affected CGI endpoint if possible or isolate the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.