CVE-2026-82692: OS Command Injection in D-Link DNS-340L

CVE-2026-82692 is an OS command injection vulnerability affecting D-Link DNS-340L and DNS-345 devices up to the 20260717 version. The vulnerability arises from improper input validation in the /cgi-bin/iscsi_mgr.cgi endpoint, where manipulation of certain parameters (alias, username, password, volume_location) allows an attacker to execute arbitrary OS commands remotely. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Exploit code has been publicly released, but no official patch or vendor advisory confirming remediation is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on affected devices without authentication or user interaction, potentially leading to full system compromise. The availability of public exploit code increases the risk of exploitation, although no in-the-wild attacks have been confirmed to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices, especially to the /cgi-bin/iscsi_mgr.cgi endpoint, and monitor for suspicious activity related to this vulnerability.