CVE-2026-8272: D-Link DNS-320 webfile_mgr.cgi chown os command injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-77

Description

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Affected products

D-Link DNS-320: 2.06b01

References

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20webfile_mgr.cgi%20Multiple%20OS%20Command%20Injection%20via%20File%20Operations.md
https://vuldb.com/submit/810079
https://vuldb.com/vuln/362569
https://vuldb.com/vuln/362569/cti
https://www.dlink.com/

Get alerted when CVE-2026-8272 or the next vulnerability affects your stack