Details of VAR-202605-3781

ID

VAR-202605-3781

CVE

CVE-2026-8273

TITLE

D-Link Corporation of D-Link DNS-320 Multiple vulnerabilities in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2026-015134

DESCRIPTION

A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-8273 // JVNDB: JVNDB-2026-015134

AFFECTED PRODUCTS

vendor:	dlink	model:	dns-320	scope:	eq	version:	2.06b01	Trust: 1.0
vendor:	d link	model:	d-link dns-320	scope:	eq	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320	scope:	eq	version:	d-link dns-320 firmware 2.06b01	Trust: 0.8

sources: JVNDB: JVNDB-2026-015134 // NVD: CVE-2026-8273

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2026-8273
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2026-8273
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2026-015134
value:	HIGH
Trust: 0.8

cna@vuldb.com:	CVE-2026-8273
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:L/AU:M/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.4
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2026-015134
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:L/AU:M/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2026-8273
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.2
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2026-8273
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2026-015134
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-015134 // NVD: CVE-2026-8273 // NVD: CVE-2026-8273

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	CWE-77	Trust: 1.0
problemtype:	Command injection (CWE-77) [ others ]	Trust: 0.8
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-015134 // NVD: CVE-2026-8273

PATCH

title:

//vuldb.com/vuln/362570

url:

https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20%20system_mgraccount_mgrdsk_mgrapp_mgr%20Multiple%20CGI%20OS%20Command%20Injection.md

Trust: 0.8

sources: JVNDB: JVNDB-2026-015134

EXTERNAL IDS

db:	NVD	id:	CVE-2026-8273	Trust: 2.6
db:	JVNDB	id:	JVNDB-2026-015134	Trust: 0.8

sources: JVNDB: JVNDB-2026-015134 // NVD: CVE-2026-8273

REFERENCES

url:	https://www.dlink.com/	Trust: 1.8
url:	https://github.com/dxz0069/wavlink-wn530h4-command-injection-in-set_add_routing/blob/main/d-link%20dns-320%20%20system_mgraccount_mgrdsk_mgrapp_mgr%20multiple%20cgi%20os%20command%20injection.md	Trust: 1.0
url:	https://vuldb.com/vuln/362570	Trust: 1.0
url:	https://vuldb.com/submit/810082	Trust: 1.0
url:	https://vuldb.com/vuln/362570/cti	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-8273	Trust: 0.8

sources: JVNDB: JVNDB-2026-015134 // NVD: CVE-2026-8273

SOURCES

db:	JVNDB	id:	JVNDB-2026-015134
db:	NVD	id:	CVE-2026-8273

LAST UPDATE DATE

2026-06-19T19:46:10.333000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-015134	date:	2026-05-13T01:20:00
db:	NVD	id:	CVE-2026-8273	date:	2026-05-11T20:31:28.817

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-015134	date:	2026-05-13T00:00:00
db:	NVD	id:	CVE-2026-8273	date:	2026-05-11T05:16:16.417