CVE-2026-82689CWE-77CWE-78command-injection

CVE-2026-82689

Critical · published August 31, 2026

CVSS v3.1
9.9
EPSS
3%
Percentile
88.4
In the wild
Unconfirmed
What it is

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.03277 · 88.4th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-31T16:17Z
References (7)
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md · [email protected]https://vuldb.com/cve/CVE-2026-82689 · [email protected]https://vuldb.com/submit/894201 · [email protected]https://vuldb.com/vuln/397177 · [email protected]https://vuldb.com/vuln/397177/cti · [email protected]https://www.dlink.com/ · [email protected]https://vuldb.com/submit/894201 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 2%
    epss
  • 31 AUG 11:15Z
    D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection
    cvelistv5