CVE-2026-16448

Publié : 21 juillet 2026

Modifié : 21 juillet 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_check_rsync_rw of the file /cgi-bin/remote_backup.cgi. The manipulation of the argument ip results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://ucn9h68n9289.feishu.cn/docx/OfhNdwzvXoBlJBxDIW7clVmjnuh?from=from_copylink https://vuldb.com/cve/CVE-2026-16448 https://vuldb.com/submit/858469 https://vuldb.com/vuln/380827 https://vuldb.com/vuln/380827/cti https://www.dlink.com/

Dernières Vulnérabilités

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

VOIR DÉTAILS

CVE-2026-63454

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution.

VOIR DÉTAILS

CVE-2026-63453

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

VOIR DÉTAILS