CVE-2026-8272: D-Link DNS-320 Firmware

High severity, CVSS 7.2. EPSS: 6% chance of exploitation in the next 30 days.

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Affected products

• D-Link DNS-320 Firmware: version 2.06b01 only

Published 2026-05-11. Last modified 2026-06-17.