Description
A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| D-Link | DNS-320 | 2.06B01 | — |
References
- VDB-362569 | D-Link DNS-320 webfile_mgr.cgi chown os command injection vdb-entry technical-description
- VDB-362569 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #810079 | D-Link Corporation DNS-320 ShareCenter NAS (Rev.A) Firmware 2.06B01 HOTFIX CWE-78: OS Command Injection third-party-advisory
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20webfile_mgr.cgi%20Multiple%20OS%20Command%20Injection%20via%20File%20Operations.md exploit
- https://www.dlink.com/ product