A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

A critical OS command injection vulnerability (CVE-2026-82689) has been identified in multiple D-Link NAS devices including DNS-320L, DNS-327L, DNS-340L, and DNS-345 up to firmware version 20260717. The vulnerability exists in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. Attackers can exploit the vulnerability by manipulating the upIsoRootPath argument to inject arbitrary OS commands. The attack can be carried out remotely without requiring physical access to the device. A public exploit is already available, significantly raising the risk of active exploitation. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. The exposure of this vulnerability with a public proof-of-concept increases the urgency for patching or mitigation measures.