CVE-2026-16447: D-Link DNS-320 RCE Vulnerability

CVE-2026-16447 Overview

CVE-2026-16447 is an unrestricted file upload vulnerability affecting D-Link DNS-320 version 1.0.2. The flaw resides in an unknown function within /web/jquery/uploader/multi_uploadify.php. Attackers can manipulate the Filedata[] argument to upload arbitrary files to the network-attached storage device without authentication. The vulnerability is categorized under [CWE-284] Improper Access Control. Remote exploitation over the network is possible, and the exploit has been publicly disclosed. The D-Link DNS-320 is a discontinued consumer NAS product, which raises concerns about the availability of vendor-supplied patches.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to affected DNS-320 devices, enabling web shell deployment and full device compromise.

Affected Products

D-Link DNS-320 firmware version 1.0.2
The /web/jquery/uploader/multi_uploadify.php component
Networked NAS deployments exposing the web management interface

Discovery Timeline

2026-07-21 - CVE-2026-16447 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16447

Vulnerability Analysis

The vulnerability exists in the multi_uploadify.php script bundled with the D-Link DNS-320 web interface. The script handles multi-file uploads via a jQuery-based uploader component. The endpoint fails to enforce access control or validate file characteristics before writing uploaded content to the filesystem. Attackers who can reach the device over the network can submit crafted HTTP POST requests containing the Filedata[] parameter to place arbitrary files onto the NAS. Exploitation does not require authentication or user interaction, and the exploit has been made public according to VulDB references.

Root Cause

The root cause is improper access control [CWE-284] combined with missing server-side validation of uploaded file types and destinations. The multi_uploadify.php handler accepts Filedata[] input and processes it without verifying the requester's identity, filtering executable extensions, or restricting the write location. This design flaw allows unrestricted file upload directly from the network.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker sends an HTTP POST request to the vulnerable multi_uploadify.php endpoint containing one or more files in the Filedata[] multipart parameter. Because the DNS-320 serves web content via an embedded HTTP server, uploaded PHP or CGI files can be requested back through the browser to trigger execution. This provides a straightforward path from unauthenticated upload to remote command execution on the NAS operating system. Devices exposed to the internet or accessible to untrusted network segments are at highest risk. See the VulDB entry for CVE-2026-16447 for additional technical context.

No verified proof-of-concept code is reproduced here. Technical details are documented in the VulDB vulnerability record #380826 and associated CTI analysis.

Detection Methods for CVE-2026-16447

Indicators of Compromise

HTTP POST requests to /web/jquery/uploader/multi_uploadify.php containing Filedata[] multipart parameters from unexpected sources
Presence of unrecognized .php, .cgi, or shell script files under the DNS-320 web root or upload directories
Outbound connections from the NAS to unknown external hosts, suggesting web shell callbacks
New user accounts or SSH keys added to the device configuration

Detection Strategies

Inspect web server access logs on the DNS-320 for requests targeting multi_uploadify.php, particularly from external or unauthenticated sessions
Monitor network flows for unusual POST payloads directed at NAS management interfaces
Perform filesystem integrity checks against a known-good baseline of the device web root

Monitoring Recommendations

Forward NAS web server and system logs to a centralized logging platform for correlation and retention
Alert on any successful HTTP 200 responses to multi_uploadify.php from outside the administrative network
Track process execution on the NAS, where feasible, to identify unexpected interpreter invocations spawned from the web server

How to Mitigate CVE-2026-16447

Immediate Actions Required

Remove D-Link DNS-320 devices from direct internet exposure and place them behind a firewall restricting management access to trusted hosts
Disable the web management interface when not actively required for administration
Audit the device filesystem for suspicious uploaded files and remove any unauthorized content
Rotate credentials and revoke any keys or tokens stored on the affected device

Patch Information

The D-Link DNS-320 is an end-of-life product line. No vendor patch is referenced in the CVE data. Refer to the D-Link official website for the latest advisories and product lifecycle information. Where no patch is available, replacement of the device with a supported NAS platform is the durable remediation path.

Workarounds

Block external access to /web/jquery/uploader/multi_uploadify.php at an upstream reverse proxy or firewall
Restrict inbound traffic to the DNS-320 web interface to a dedicated management VLAN
Segment the NAS onto an isolated network with no direct route to untrusted zones
Plan migration to a currently supported storage platform to eliminate exposure to unpatched flaws

bash

# Example firewall rule to restrict DNS-320 web access to a management subnet
iptables -A FORWARD -p tcp -d <DNS320_IP> --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <DNS320_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <DNS320_IP> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <DNS320_IP> --dport 443 -j DROP