A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A critical OS command injection vulnerability has been identified in D-Link DNS-340L firmware version 1.01B04. The vulnerability exists in the /cgi-bin/dropbox.cgi file within the CGI Handler component. An attacker can exploit this by manipulating the callback_url or sync_interval arguments to inject arbitrary OS commands. The attack can be initiated remotely without requiring physical access to the device. A public exploit has been released, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-85223 and is tracked across multiple vulnerability databases including NVD and VulDB. D-Link NAS devices are commonly deployed in home and small business environments, making this a significant risk for a wide range of users. No patch information is explicitly mentioned in the article.