Vulnerability Intelligence Report
D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection
CVE-2026-82688
A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Injection
No Active Exploit Signals
CVSS Base Score
9.4
CRITICAL
EPSS Probability:2.79%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| D-Link | DNS-340L | 1.01B04 (affected), 1.03B06 (affected), 1.04.B02 (affected), 1.05b04 (affected) |
| D-Link | DNS-345 | 1.01B04 (affected), 1.03B06 (affected), 1.04.B02 (affected), 1.05b04 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulDB · Researcher · Switzerland |
| Reserved | 2026-08-30T17:35:22 |
| Published | 2026-08-31T11:00:10 |
| Last Updated | 2026-09-01T18:10:58 |
Community Chatter & Buzz