CVE-2026-16332: D-Link DNS-320 RCE Vulnerability

CVE-2026-16332 Overview

CVE-2026-16332 is an unrestricted file upload vulnerability in D-Link DNS-320 network-attached storage devices running firmware version 1.0.2. The flaw resides in the /mydlink/multi_uploadify.php script, where the Filedata[] parameter is processed without proper access controls or file type validation. Remote attackers can exploit the issue over the network without authentication or user interaction. A public exploit is available, increasing the likelihood of opportunistic scanning and targeting. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to affected DNS-320 devices, potentially leading to web shell deployment and persistent device compromise.

Affected Products

D-Link DNS-320 firmware version 1.0.2
Deployments exposing the /mydlink/ web interface to untrusted networks
End-of-life D-Link NAS devices that no longer receive vendor patches

Discovery Timeline

2026-07-21 - CVE-2026-16332 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-16332

Vulnerability Analysis

The D-Link DNS-320 exposes a PHP endpoint at /mydlink/multi_uploadify.php that accepts multi-file uploads through the Filedata[] HTTP parameter. The script fails to enforce authentication and does not restrict the type, extension, or destination of uploaded content. As a result, an attacker with network reachability to the device can write arbitrary files, including executable PHP scripts, into web-served directories.

Once a malicious file is placed inside a location handled by the device's web server, the attacker can request the uploaded resource to gain remote command execution in the context of the web process. This creates a pivot point for lateral movement, data exfiltration from stored shares, or deployment of persistent malware on the NAS.

The DNS-320 line reached end-of-service status, so official firmware corrections are not expected. Organizations still operating these devices should treat any exposed instance as compromised until validated.

Root Cause

The root cause is improper access control on the multi_uploadify.php handler combined with missing validation of the uploaded file's name, extension, and MIME type. The script trusts client-supplied input from the Filedata[] array and writes content directly to disk without permission checks.

Attack Vector

Exploitation requires only network access to the device's HTTP interface. The attacker sends a crafted multipart/form-data POST request to /mydlink/multi_uploadify.php containing one or more files in the Filedata[] parameter. Because the exploit is public, automated scanners can identify and target vulnerable devices at scale. See the VulDB entry for CVE-2026-16332 for further technical context.

Detection Methods for CVE-2026-16332

Indicators of Compromise

HTTP POST requests to /mydlink/multi_uploadify.php from external or unexpected internal sources
Newly created PHP, CGI, or script files inside /mydlink/ or other web-served directories on the NAS
Outbound connections from the DNS-320 to unfamiliar hosts following upload activity
Web server process spawning shell interpreters such as sh, bash, or busybox

Detection Strategies

Inspect web access logs on the NAS or upstream reverse proxies for requests targeting multi_uploadify.php with Filedata[] parameters
Deploy network IDS signatures matching multipart uploads to the vulnerable endpoint
Perform file integrity monitoring on web-accessible directories of the DNS-320 to detect unauthorized additions

Monitoring Recommendations

Alert on any external HTTP traffic reaching management interfaces of legacy NAS devices
Baseline outbound traffic from storage appliances and flag deviations that could indicate command-and-control activity
Review authentication and administrative logs on the device for unexpected account creation or configuration changes

How to Mitigate CVE-2026-16332

Immediate Actions Required

Remove D-Link DNS-320 devices from any network segment reachable from the internet
Restrict access to the /mydlink/ interface using firewall or ACL rules that permit only trusted management hosts
Audit the device filesystem for unauthorized files, especially recently modified scripts under web-served directories
Plan migration to a supported storage platform, as the DNS-320 product line no longer receives security updates

Patch Information

No vendor patch is available for CVE-2026-16332. The D-Link DNS-320 is an end-of-life product, and D-Link has historically recommended retirement rather than patching for this family of devices. Consult the D-Link Security Portal for the vendor's current guidance on unsupported hardware.

Workarounds

Place the device behind a segmented VLAN with strict inbound filtering to block untrusted access to TCP port 80/443
Disable or block the /mydlink/multi_uploadify.php endpoint via an upstream reverse proxy where feasible
Decommission the DNS-320 and migrate stored data to a currently supported NAS platform with active security maintenance

bash

# Example firewall rule to block external access to the DNS-320 management interface
iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/0 -d <DNS-320-IP> -j DROP
iptables -A INPUT -p tcp --dport 443 -s 0.0.0.0/0 -d <DNS-320-IP> -j DROP
# Allow only a trusted management subnet
iptables -I INPUT -p tcp --dport 80 -s 10.10.0.0/24 -d <DNS-320-IP> -j ACCEPT