D-Link DNS-340L/345 virtual_vol.cgi Authenticated OS Command Injection (CWE-78)

Vulnerability Intelligence Summary Vulnerability Overview Vulnerability Name: D-Link DNS-340L/DNS-345 Virtual Volume CGI OS Command Injection Vulnerability Type: OS Command Injection (CWE-78) CVSS v3.1 Score: 8.8 (High) Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Root Cause: The CGI handler for directly concatenates HTTP POST parameters (e.g., , , ) into shell commands executed via without escaping or whitelist validation, allowing an authenticated attacker to inject shell metacharacters to execute arbitrary commands. Scope of Impact Vendor: D-Link Affected Products: DNS-340L ShareCenter, DNS-345 ShareCenter Affected Firmware Versions: - DNS-340L: REVA_1.01B04 - DNS-345: REVA_1.03B06, 1.04.B02, 1.05B04 Affected Components: , Architecture: ARM EABI32 Little-Endian Impact: An authenticated attacker can modify files, add/remove persistent storage, and disrupt service; the virtual volume page is part of the authenticated admin interface, constituting an authenticated remote code execution vulnerability. Versions Tested as Unaffected: DNS-345 REVA_1.04B01, 1.05B05, 1.06B02, 1.07B02, PATCH_1.05.B04, PATCH_1.07B01, 1.08B01 (in these versions, execution paths are built with arbitrary writable , preventing shell execution or command injection). Remediation (Mitigation Recommendations) 1. Replace with or an equivalent API to avoid invoking the shell. 2. Apply static whitelist validation to parameters such as , , , , , and . 3. Reject inputs containing shell metacharacters or unexpected wildcards. 4. Enforce authentication and authorization checks before executing virtual volume management operations. POC / Exploit Code (Complete Extraction) Low-risk Marker Examples (PoC Requests): Runtime Marker Results (Controlled Markers / Shell Execution Traces): Representative Git Status Evidence (Observed Vulnerable Command Templates at Runtime): Representative Git Status Evidence (Specific Firmware): DNS-340L_1.01B04: DNS-345_1.04.B02: Other Key Information Internal Tracking ID: DLINK-CMD-001 Validation Status: Confirmed (CONFIRMED) Validation Evidence: Command/QUERy marker evidence + duplicate check (D-Link evidence package) Disclosure Timeline: Vendor notification/coordinated, CVE/VulnDB assignment, and public disclosure are all TBD Duplicate Check: As of 2026-05-26, no matching public CVE or disclosure for D-Link DNS-340L/DNS-345 virtual volume CGI was found; NVD API queries (e.g., , , ) returned 0 CVE records.

Goal Reached Thanks to every supporter — we hit 100%!

D-Link DNS-340L/345 virtual_vol.cgi Authenticated OS Command Injection (CWE-78)

More from this source