CVE-2026-8273

Опубликовано: 11 мая 2026

Источник: nvd

CVSS3: 4.7

CVSS3: 7.2

CVSS2: 5.8

EPSS Низкий

Описание

A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.

Ссылки

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20%20system_mgraccount_mgrdsk_mgrapp_mgr%20Multiple%20CGI%20OS%20Command%20Injection.md
Exploit
Third Party Advisory
https://vuldb.com/submit/810082
Third Party Advisory
VDB Entry
https://vuldb.com/vuln/362570
Third Party Advisory
VDB Entry
https://vuldb.com/vuln/362570/cti
Permissions Required
VDB Entry
https://www.dlink.com/
Product
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20%20system_mgraccount_mgrdsk_mgrapp_mgr%20Multiple%20CGI%20OS%20Command%20Injection.md
Exploit
Third Party Advisory
https://vuldb.com/submit/810082
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:dlink:dns-320_firmware:2.06b01:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.04544

Низкий

4.7 Medium

CVSS3

7.2 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-77

CWE-78

Связанные уязвимости

GHSA-5jp6-jc7m-x7q9

CVSS3: 4.7

github

3 месяца назад

BDU:2026-08533

CVSS3: 7.2

fstec

3 месяца назад

Уязвимость сценариев system_mgr.cgi, account_mgr.cgi, dsk_mgr.cgi и app_mgr.cgi микропрограммного обеспечения сетевых хранилищ D-Link DNS-320, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 91%

0.04544

Низкий

4.7 Medium

CVSS3

7.2 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-77

CWE-78