CVE-2026-16330: D-Link DNS-320 RCE Vulnerability

CVE-2026-16330 Overview

CVE-2026-16330 is an unrestricted file upload vulnerability in the D-Link DNS-320 network-attached storage device running firmware version 1.0.2. The flaw resides in the /web/jquery/uploader/uploadify.php script, which fails to validate uploaded file types. Remote attackers can exploit the vulnerability over the network without authentication or user interaction. The weakness is classified under [CWE-284: Improper Access Control]. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed devices.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to affected D-Link DNS-320 devices, potentially leading to code execution, data tampering, or persistent device compromise.

Affected Products

D-Link DNS-320 firmware version 1.0.2
/web/jquery/uploader/uploadify.php upload handler component
Legacy D-Link network-attached storage (NAS) devices exposing the web management interface

Discovery Timeline

2026-07-21 - CVE-2026-16330 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16330

Vulnerability Analysis

The vulnerability affects the file upload handler at /web/jquery/uploader/uploadify.php on the D-Link DNS-320 NAS. The script accepts uploaded files without properly validating the file type, extension, or content. This allows an attacker to submit arbitrary files, including server-executable scripts, to the device's web root.

Because the device processes uploads without enforcing authentication controls, an attacker can reach the endpoint directly over the network. The D-Link DNS-320 reached end-of-life status years ago, meaning no vendor patch is expected for the affected firmware line.

Root Cause

The root cause is improper access control combined with missing file-type validation in uploadify.php. The handler trusts client-supplied metadata and does not restrict the destination directory or the permitted MIME types. This design flaw allows unrestricted uploads to reach a location where the web server may execute them.

Attack Vector

Exploitation occurs remotely over the network. An attacker crafts an HTTP POST request to the vulnerable uploadify.php endpoint containing a malicious payload. Once written to disk, the payload can be requested through the web interface to trigger execution or data manipulation on the NAS. Publicly available exploit details lower the barrier to weaponization.

See the VulDB entry for CVE-2026-16330 and the associated CTI record for additional technical context.

Detection Methods for CVE-2026-16330

Indicators of Compromise

HTTP POST requests targeting /web/jquery/uploader/uploadify.php from unexpected external sources
Presence of unfamiliar script files (.php, .sh, .cgi) in the DNS-320 web directories
Outbound connections from the NAS to unknown command-and-control infrastructure following an upload event

Detection Strategies

Inspect web server access logs for POST activity to uploadify.php, particularly requests carrying executable payloads or unusual Content-Type headers
Baseline the DNS-320 file system and alert on new or modified files within web-accessible directories
Monitor for anomalous process execution or spawned shells originating from the web service account

Monitoring Recommendations

Forward NAS access logs and network flow data to a centralized SIEM for correlation with threat intelligence feeds
Enable network-level detection for HTTP requests to legacy D-Link management paths across ingress and egress points
Track authentication and administrative changes on the device to identify post-exploitation persistence attempts

How to Mitigate CVE-2026-16330

Immediate Actions Required

Remove D-Link DNS-320 devices from any network segment reachable from the internet or untrusted VLANs
Disable the web management interface if the device must remain operational for storage services
Audit the NAS file system for unauthorized uploads and rotate any credentials that may have been exposed

Patch Information

The D-Link DNS-320 is a legacy product line and no vendor patch has been published for CVE-2026-16330. Refer to the D-Link support portal to confirm end-of-life status and evaluate supported replacement hardware. Organizations still operating the DNS-320 should treat the device as unpatchable and plan for decommissioning.

Workarounds

Place the NAS behind a firewall or reverse proxy that blocks external requests to /web/jquery/uploader/uploadify.php
Apply strict network access control lists so that only authorized management workstations can reach the device
Replace the DNS-320 with a currently supported NAS platform that receives active security updates

bash

# Example firewall rule to block external access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/web/jquery/uploader/uploadify.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/web/jquery/uploader/uploadify.php" --algo bm -j DROP