by Kastro
Paper/Archive/CVE-2026-85224

CVE-2026-85224

D-Link DNS-320 ShareCenter — D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

EPSS 4%public exploitCVSS 9.4
critical.is priorityof 100
56
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 89.5.895 × 2017.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected

ProductAffectedFixed inSource
DNS-320 ShareCenter2.06B01–CNA

Scores by source

VulDB (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
VulDB (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/vuln/398423refvuldb.com/vuln/398423/ctiwriteupvuldb.com/cve/CVE-2026-85224writeupvuldb.com/submit/894215exploitgithub.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-010-vulndb.mdrefdlink.com