Description
A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-03
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Add‑On Center on the D‑Link DNS‑340L allows an attacker to manipulate the f_name/f_url/f_flag/f_login_user parameters of /cgi-bin/addon_center.cgi, resulting in OS command injection. This vulnerability lets an unauthenticated remote user execute arbitrary commands on the device, compromising confidentiality, integrity, and availability of the router and any network resources it manages.

Affected Systems

D‑Link DNS‑340L firmware 1.01B04 is affected. The vulnerability is tied to the Add‑On Center component accessed via /cgi-bin/addon_center.cgi.

Risk and Exploitability

The CVSS score is 9.4, indicating a critical severity. The EPSS score is unknown, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote, relying on HTTP/HTTPS requests to the vulnerable CGI endpoint. An attacker can trigger the injection by sending specially crafted values for the mentioned parameters without needing authentication or prior access to the device.

Generated by OpenCVE AI on September 3, 2026 at 22:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the DNS‑340L firmware to a version that fixes the command‑injection flaw; check the vendor’s support site for the latest release.
  • If an update is not yet available, restrict or disable the Add‑On Center feature or block access to /cgi-bin/addon_center.cgi through the device’s web interface or an external firewall.
  • Block or limit remote HTTP/S access to the router to only trusted networks, and consider applying network segmentation to isolate the device from untrusted traffic.

Generated by OpenCVE AI on September 3, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Title D-Link DNS-340L Add-On Center addon_center.cgi os command injection
First Time appeared D-link
D-link dns-340l
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:h:d-link:dns-340l:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dns-340l
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

D-link Dns-340l
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T21:00:10.616Z

Reserved: 2026-09-03T14:24:29.466Z

Link: CVE-2026-85222

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T21:17:23.990

Modified: 2026-09-03T21:17:23.990

Link: CVE-2026-85222

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T22:30:10Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')