Security readout for executives and security teams
Plain-English summary
A flaw in the D-Link DNS-340L Add-On Center may let a highly privileged remote user run operating-system commands through the device’s management interface. Successful exploitation could compromise the device and affect data confidentiality, integrity, and availability. Public exploit information exists, but the supplied sources do not establish active exploitation.
Executive priority
Treat confirmed 1.01B04 deployments as urgent. Immediately reduce management-interface exposure, review privileged access, and seek vendor remediation guidance. Prioritize replacement or isolation if no supported fix exists, especially for devices holding sensitive data or supporting critical operations.
Technical view
CVE-2026-85222 is an OS command-injection vulnerability in /cgi-bin/addon_center.cgi on D-Link DNS-340L firmware 1.01B04. Manipulation of f_name, f_url, f_flag, or f_login_user can reach command execution. CVSS 4.0 rates it 9.4; network access and high privileges are required, without user interaction.
Likely exposure
Confirmed scope is limited to D-Link DNS-340L firmware 1.01B04. Risk is greatest where the management interface and Add-On Center endpoint are reachable by untrusted networks or credentials are compromised. The bundle does not confirm other models or firmware versions.
Exploitation context
Technical exploit information has been publicly disclosed, increasing reproducibility risk. However, CVE-2026-85222 is not listed as KEV in the supplied bundle, and no cited source confirms exploitation in the wild. High privileges are reportedly required before exploitation.
Researcher notes
The reported weakness maps to CWE-77 and CWE-78. The source bundle identifies four controllable arguments but does not clarify sanitization boundaries, affected HTTP methods, authentication mechanics, patch availability, or broader firmware coverage. Validation should remain non-destructive and avoid reproducing the public exploit against production systems.
Mitigation direction
- Identify DNS-340L devices running firmware 1.01B04.
- Restrict management access to trusted administrators and networks.
- Prevent internet exposure of the management interface.
- Check D-Link guidance for supported firmware, patches, or replacement advice.
- Consider isolating affected devices until authoritative remediation is available.
Validation and detection
- Inventory DNS-340L devices and record their exact firmware versions.
- Verify whether /cgi-bin/addon_center.cgi is reachable from untrusted networks.
- Review administrative accounts, authentication logs, and unexpected configuration changes.
- Inspect device and surrounding network telemetry for unexplained command execution or outbound activity.
- Confirm mitigations without sending command-injection payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-85222 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDBCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R2.36VulDBCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R2.36VulDBAV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR6.410VulDBVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
9.1CriticalVector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
8.3HighVector: AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-398421 | D-Link DNS-340L Add-On Center addon_center.cgi os command injectionCVE reference, VulDB · vdb-entry, technical-description
- VDB-398421 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-85222 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #894212 | D-Link DNS-340L ShareCenter confirmed DNS-340L firmware builds OS Command InjectionCVE reference, VulDB · third-party-advisory
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-007-vulndb.mdCVE reference, VulDB · exploit
- https://www.dlink.com/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.