CVE-2026-85222: D-Link DNS-340L Command Injection Has No Fix Coming

Overview

A critical OS command injection vulnerability has been publicly disclosed in the D-Link DNS-340L network-attached storage (NAS) appliance. Tracked as CVE-2026-85222, the flaw sits in the device's /cgi-bin/addon_center.cgi endpoint — the "Add-On Center" component used to install third-party packages — and lets a remote, unauthenticated attacker execute arbitrary operating-system commands. A public exploit is already circulating.

The device is End of Life: D-Link has confirmed it will not release a firmware update to address this issue, meaning every internet-exposed DNS-340L running the affected firmware is permanently vulnerable short of replacement or strict network isolation.

Technical Details

How It Works

The Add-On Center CGI script accepts several parameters — f_name, f_url, f_flag, and f_login_user — that are used to fetch and install add-on packages onto the NAS. The script passes attacker-controlled values from these parameters into a system command without adequate sanitization, allowing an attacker to append shell metacharacters and inject arbitrary commands that execute with the device's privileges. Because the endpoint requires no authentication and is reachable remotely, exploitation requires nothing more than network access to the device's management interface.

This disclosure is part of a broader wave of similar OS command injection flaws recently found across the D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L legacy NAS line, including comparable bugs in iscsi_mgr.cgi, usb_device.cgi, ve_mgr.cgi, and remote_backup.cgi — suggesting the underlying CGI framework shares the same unsafe command-construction pattern across multiple endpoints.

Impact Assessment

Who Is At Risk

• Any organization or individual still operating a DNS-340L on firmware 1.01B04 reachable from the internet or an untrusted network segment
• Small businesses and home users who deployed these NAS units years ago and have since stopped tracking their patch status — a common outcome for EOL consumer/SMB storage hardware
• Environments where the NAS management interface was exposed for remote-access convenience (port forwarding, DDNS, etc.)

Potential Attack Chain

1. Unauthenticated Request — Attacker sends a crafted request to /cgi-bin/addon_center.cgi with malicious shell metacharacters in f_name/f_url/f_flag/f_login_user
2. Command Execution — The injected command runs with the CGI process's privileges, effectively granting root-level access on the appliance
3. Data Exposure — Any files stored on the NAS become accessible to the attacker
4. Lateral Movement / Botnet Recruitment — A compromised NAS can serve as a foothold into the local network or be conscripted into a DDoS botnet, a common fate for exploited EOL D-Link devices

Mitigation

Because D-Link has not committed to a patch for this End-of-Life product, mitigation is entirely the operator's responsibility:

Immediate Actions

• Remove the device from the internet — disable any port forwarding, UPnP, or DDNS configuration exposing the DNS-340L's management interface externally
• Isolate on the local network — place the NAS on a segmented VLAN with access restricted to only the systems that need it
• Disable the Add-On Center feature if it is not actively in use, reducing the exposed attack surface
• Plan hardware replacement — an EOL device with a public, unpatched RCE exploit should be treated as a retirement candidate, not a long-term mitigation target

Detection Opportunities

• Unexpected outbound connections or processes spawned from the NAS's CGI runtime
• Unusual requests to /cgi-bin/addon_center.cgi in reverse-proxy or firewall logs, particularly containing shell metacharacters
• Unexplained changes to files or installed add-on packages on the device

Background

Legacy D-Link NAS appliances have a long track record of CGI-based command injection flaws, and the DNS-320/325/340L family in particular has accumulated a growing list of similar disclosures targeting different CGI endpoints. With the vendor declining to patch End-of-Life hardware, these devices increasingly function as low-hanging fruit for opportunistic botnet operators scanning the internet for exposed management interfaces — a pattern seen repeatedly with abandoned consumer and SMB network hardware.

References

• Exploit-DB — D-Link DNS_340L OS Command Injection
• OffSeq Threat Radar — CVE-2026-85222
• NVD — CVE-2026-85222