CVE-2026-82689: D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-08-31
Weakness: CWE-77

Description

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

Affected products

D-Link DNS-320L: 20260717
D-Link DNS-327L: 20260717
D-Link DNS-340L: 20260717
D-Link DNS-345: 20260717

References

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md
https://vuldb.com/cve/CVE-2026-82689
https://vuldb.com/submit/894201
https://vuldb.com/vuln/397177
https://vuldb.com/vuln/397177/cti
https://www.dlink.com/
https://vuldb.com/submit/894201

Get alerted when CVE-2026-82689 or the next vulnerability affects your stack