/DISPATCH · 2026-09-03

CVE-2026-82689: D-Link NAS Command Injection Advisory, CVSS 9.9, Exploit Code Public

D-Link DNS-320L/327L/340L/345 firmware 20260717 and earlier have CVSS 9.9 OS command injection in ISO Image Handler. Unauthenticated remote attackers can exploit it. Exploit code is public.

CVE-2026-82689 is a critical vulnerability in multiple D-Link NAS devices: DNS-320L, DNS-327L, DNS-340L, and DNS-345 running firmware 20260717 and earlier. The ISO Image Handler component has an OS command injection flaw, CVSS 9.9. Unauthenticated remote attackers can execute arbitrary commands. Exploit code is public.

Incident Overview

Affects mainstream D-Link NAS models for SMBs and home users. Firmware 20260717 and earlier are vulnerable. ISO Image Handler is the Web UI component that processes ISO images. Crafted requests inject OS commands and execute arbitrary instructions at device privilege. Security vendors have confirmed public exploit code.

Technical Details

Type: unauthenticated OS command injection (CWE-78). Fully remote network vector. No user interaction, no credentials. D-Link NAS devices have a large installed base and are often exposed on the public internet for remote file access. Historically prime targets for Mirai-class botnets and opportunistic attackers. With public exploit code, widespread in-the-wild exploitation should be treated as likely.

Impact Assessment

CVSS 9.9 (Critical). Successful exploitation yields full device control: steal files on the NAS, drop miner or botnet payloads, pivot into the internal network, or destroy stored data. Some older D-Link models are end-of-life and may never receive official firmware. Long-tail risk remains.

Remediation

Check device model and firmware version immediately. Confirm a fixed firmware on the D-Link official support page and upgrade.
Replace devices that are no longer maintained, or at minimum take them off the public internet and restrict them to a controlled internal network.
Temporary mitigation: firewall-restrict management UI access sources; disable unnecessary public port mappings and remote access.
Detection: monitor Web logs for anomalous requests to ISO Image Handler endpoints. Flag parameter values containing pipe, backtick, semicolon, and other command-injection indicators.

References

Enigma Global daily threat intel digest (2026-09-02)