CVE-2026-16447 in DNS-320
Summary
by MITRE • 07/21/2026
A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability in D-Link DNS-320 firmware version 1.0.2 represents a critical security flaw that allows remote attackers to execute arbitrary code through an unrestricted file upload mechanism. The affected component is located within the web interface at /web/jquery/uploader/multi_uploadify.php, where the Filedata[] parameter fails to properly validate or sanitize uploaded files. This weakness creates an exploitable entry point that enables attackers to bypass security controls and upload malicious files to the device's filesystem. The vulnerability falls under CWE-434 which specifically addresses unrestricted file upload scenarios where applications fail to properly validate file types, sizes, or content before storing them on the server.
The technical implementation of this flaw stems from inadequate input validation within the multi_uploadify.php script that processes file uploads through the Filedata[] parameter. When an attacker submits a file through this interface without proper authentication or authorization checks, the system accepts and stores the file without verifying its contents against a whitelist of allowed extensions or performing content analysis. This allows malicious actors to upload web shells, malware, or other harmful payloads directly onto the device's storage. The vulnerability is particularly dangerous because it enables remote exploitation without requiring any prior authentication credentials, making it accessible to anyone who can reach the device's web interface.
The operational impact of this vulnerability extends beyond simple unauthorized file uploads as it provides a persistent backdoor for attackers to maintain long-term access to the device and potentially compromise the entire network. Once an attacker successfully uploads a malicious file, they can execute arbitrary commands on the device, potentially leading to complete system compromise, data exfiltration, or use of the device as a pivot point for attacking other systems within the local network. The public disclosure of this exploit increases the risk significantly as it provides attackers with ready-made tools and techniques to target vulnerable D-Link DNS-320 devices. This vulnerability aligns with ATT&CK technique T1195 which covers content injection attacks where adversaries inject malicious code into applications or systems through file upload mechanisms.
Organizations should immediately implement mitigations including firmware updates from D-Link, network segmentation to isolate affected devices, and deployment of intrusion detection systems to monitor for suspicious file upload activities. The most effective long-term solution involves patching the firmware to properly validate all uploaded files against strict whitelists and implementing proper access controls. Additionally, security teams should conduct comprehensive audits of their network infrastructure to identify other potentially vulnerable D-Link devices or similar systems that may be susceptible to the same class of vulnerability. The incident highlights the critical importance of input validation in web applications and demonstrates how seemingly simple functionality like file uploads can become catastrophic security weaknesses when not properly secured.