CVE-2026-85223: OS Command Injection in D-Link DNS-340L

This vulnerability affects D-Link DNS-340L version 1.01B04. It arises from improper input handling in the /cgi-bin/dropbox.cgi CGI script, where the callback_url and sync_interval parameters can be manipulated to inject and execute arbitrary operating system commands. The attack vector is remote network access with low complexity and no required privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with high impact on confidentiality, integrity, availability, and security requirements. No official fix or mitigation has been documented by the vendor.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device, unauthorized access to sensitive information, disruption of service, or further network penetration. The vulnerability affects confidentiality, integrity, availability, and security controls at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces, especially the /cgi-bin/dropbox.cgi endpoint, to trusted users only. Monitor for unusual activity related to this CGI script. Avoid exposing the device to untrusted networks.