Security readout for executives and security teams
Plain-English summary
A flaw in four D-Link ShareCenter NAS models may let an authenticated remote attacker run operating-system commands through the ISO image feature. Successful exploitation could expose stored data, alter the device, or disrupt service. Public exploit material increases urgency, although the supplied evidence does not establish active exploitation.
Executive priority
Treat affected, reachable devices as an immediate remediation priority because compromise could expose NAS data and disrupt operations. Remove external reachability now, determine whether supported vendor remediation exists, and prioritize isolation or replacement where it does not. Escalate incident review for devices previously exposed to untrusted networks.
Technical view
The ISO Image Handler at /cgi-bin/isomount_mgr.cgi improperly handles the upIsoRootPath argument, enabling OS command injection. The CVSS 3.1 vector indicates network access, low attack complexity, low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations using D-Link DNS-320L, DNS-327L, DNS-340L, or DNS-345 devices within the stated affected range may be exposed. Risk is greatest when the CGI endpoint is Internet-facing or reachable from untrusted networks. Authentication is reportedly required, but compromised or low-privilege credentials may still enable exploitation.
Exploitation context
The supplied record states that exploit material is public and may be used. The CVE is not identified as a KEV entry, and no supplied source establishes active exploitation in the wild. Public availability nevertheless reduces the barrier to attempted attacks.
Researcher notes
Affected-version reporting is ambiguous: the description says “up to 20260717,” while structured entries list “20260717.” The submission references multiple confirmed firmware builds, but the bundle provides no D-Link advisory, definitive firmware matrix, patch information, or evidence of active exploitation. Validate product scope directly with D-Link before closing findings.
Mitigation direction
- Inventory D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 devices and record firmware identifiers.
- Remove the affected CGI interface from Internet exposure and restrict access to trusted management networks.
- Apply verified D-Link corrective firmware or replacement guidance; the supplied sources name no patch.
- If no supported fix exists, isolate or retire affected devices based on business criticality.
- Review potentially exposed devices for compromise before returning them to service.
Validation and detection
- Confirm model and firmware identifiers, resolving the ambiguous “20260717” affected-version notation with D-Link.
- Verify /cgi-bin/isomount_mgr.cgi is not reachable from the Internet or untrusted network segments.
- Confirm only trusted authenticated users can access ISO image management functions.
- Review web, authentication, and system logs for suspicious requests or unexpected command execution around the CGI endpoint.
- After remediation, verify approved firmware, isolation controls, and endpoint reachability without attempting exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-82689 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.16VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.16VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDBAV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810VulDBVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
9.9CriticalVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-397177 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injectionCVE reference, VulDB · vdb-entry, technical-description
- VDB-397177 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-82689 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #894201 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmware builds OS Command InjectionCVE reference, VulDB · third-party-advisory
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.mdCVE reference, VulDB · exploit
- https://www.dlink.com/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.