A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

A critical OS command injection vulnerability has been identified in multiple D-Link NAS devices, including the DNS-320L, DNS-327L, DNS-340L, and DNS-345 models up to firmware version 20260717. The vulnerability resides in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. By manipulating the 'upIsoRootPath' argument, an attacker can inject arbitrary OS commands. The attack is remotely exploitable without requiring physical access to the device. A public exploit is already available, significantly increasing the risk of active exploitation in the wild. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. Users are advised to apply patches or mitigations as soon as they become available from D-Link.