CVE-2026-16448 in DNS-120
Summary
by MITRE • 07/21/2026
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_check_rsync_rw of the file /cgi-bin/remote_backup.cgi. The manipulation of the argument ip results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability affects multiple D-Link network video recorder and storage devices including models such as DNS-120, DNR-202L, and various DNS-3xx series units. The flaw exists within the remote_backup.cgi web script where the cgi_check_rsync_rw function processes user-supplied input without proper sanitization or validation. When an attacker provides malicious input to the ip parameter, the system fails to properly escape or validate this data before using it in system command execution contexts. This represents a classic command injection vulnerability that allows remote attackers to execute arbitrary commands on the affected devices with the privileges of the web server process.
The technical implementation of this vulnerability stems from improper input handling within the web application layer of these network appliances. The cgi_check_rsync_rw function directly incorporates user-provided ip argument values into shell commands without appropriate sanitization measures, creating a path for attackers to inject malicious shell commands that get executed by the underlying operating system. This type of vulnerability maps directly to CWE-77 and CWE-88 within the Common Weakness Enumeration framework, specifically categorized as command injection due to insufficient input validation and improper escaping of special characters.
The operational impact of this vulnerability is severe for organizations relying on these D-Link devices for surveillance and network storage operations. Remote exploitation allows attackers to gain unauthorized access to the device's operating system, potentially enabling complete compromise of the appliance. Attackers could execute arbitrary code with elevated privileges, access stored video footage, modify system configurations, or use the device as a pivot point for attacking other systems within the local network. The public availability of exploits increases the likelihood of automated attacks against vulnerable devices across the internet.
Mitigation strategies should include immediate firmware updates from D-Link to address the command injection vulnerability, network segmentation to limit access to these devices, and implementation of network monitoring to detect suspicious command execution patterns. Organizations should also consider disabling unnecessary remote management features, implementing strong authentication mechanisms, and regularly reviewing device configurations for unauthorized changes. The vulnerability aligns with ATT&CK technique T1059 which covers command and scripting interpreter, and T1071 which involves application layer protocol usage for command execution. Network administrators should prioritize patching these devices as the root cause lies in inadequate input validation within the web application's CGI script processing logic.