CVE-2026-85222: OS Command Injection in D-Link DNS-340L

This vulnerability in D-Link DNS-340L version 1.01B04 involves an OS command injection via the /cgi-bin/addon_center.cgi script in the Add-On Center component. By manipulating the parameters f_name, f_url, f_flag, or f_login_user, an attacker can remotely execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and has a critical severity rating (CVSS 9.4). Although the exploit has been publicly disclosed, there is no vendor-provided patch or official remediation information available at this time.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the system. This can result in unauthorized control, data theft, or disruption of device functionality. The vulnerability is critical due to its remote exploitability and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected device's management interfaces to trusted users only. Monitor for any updates from D-Link regarding patches or mitigations.