CVE-2026-85224 in DNS-320 ShareCenter
Summary
by MITRE • 09/04/2026
A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/06/2026
The D-Link DNS-320 ShareCenter, specifically running firmware version 2.06B01, contains a critical security flaw within its web-based management interface that allows for remote code execution. This vulnerability resides in the file_sharing.cgi component, which is responsible for handling requests related to file sharing operations over HTTP. The specific point of failure involves improper validation and sanitization of input data passed via the fileurl argument. When an attacker constructs a malicious request containing specially crafted payloads within this parameter, the underlying system fails to adequately filter out shell metacharacters or command separators before passing the value to operating system-level commands for processing. This lack of rigorous input validation creates a direct pathway for OS command injection, enabling an adversary to execute arbitrary system commands with the privileges associated with the web server process, which typically includes root access on embedded Linux devices like this NAS appliance.
From a technical perspective, this flaw is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The vulnerability allows for remote exploitation without requiring any form of authentication or user interaction beyond sending the crafted HTTP request to the target device's web server port. Because the exploit has been publicly disclosed and is available for use by threat actors, the risk level is significantly elevated. Attackers can leverage automated scanning tools to identify vulnerable instances across the internet, leading to potential compromise of the device itself as well as any data stored on its attached drives. The operational impact extends beyond simple unauthorized access; successful exploitation could result in complete system takeover, allowing attackers to install persistent backdoors, exfiltrate sensitive files, or use the compromised NAS as a pivot point for further attacks against other devices within the local network segment.
The presence of this vulnerability highlights broader issues common in embedded IoT and networking equipment, where security is often secondary to functionality during development cycles. The file_sharing.cgi script likely invokes system utilities such as cp, mv, or rm with user-supplied arguments without sufficient boundary checks. This aligns with the MITRE ATT&CK framework technique T1059 Command and Scripting Interpreter, specifically through indirect command execution via a web application interface. Furthermore, it reflects CWE-20 Improper Input Validation, where the system does not restrict or incorrectly filters inputs that could alter intended control flow or execute unintended commands. Given the public availability of exploits for this specific firmware version, organizations relying on older DLink hardware are at immediate risk if these devices remain connected to untrusted networks or lack adequate network segmentation controls.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the device firmware to a patched version that addresses the input validation flaws in file_sharing.cgi, provided such an update exists from D-Link for this legacy model. If no patch is available or feasible due to end-of-life status, network-level controls should be implemented immediately. This includes placing the NAS behind strict firewall rules that restrict access to the management interface only from trusted IP addresses and disabling remote administration features entirely if not required. Additionally, deploying intrusion detection systems with signatures for known command injection payloads can help identify attempted exploitation in real-time. For environments where legacy hardware cannot be replaced or updated promptly, network segmentation is critical; isolating storage devices on a separate VLAN prevents lateral movement should the device be compromised. Regular vulnerability assessments and continuous monitoring of attack surfaces are essential to maintain security posture against evolving threats targeting embedded systems with known public exploits.