An authenticated OS command injection vulnerability in D-Link DNS-340L and DNS-345 NAS devices poses a critical risk of full system compromise.

This is an OS command injection flaw (CWE-78) within the virtual_vol.cgi file. An authenticated attacker can manipulate HTTP POST parameters, specifically f_sharename, f_target, and f_name, to inject shell metacharacters that are executed by the underlying system shell.

Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the CGI process, effectively granting them full control over the NAS appliance. This could lead to unauthorized access to sensitive stored data, the installation of persistent backdoors, or the use of the device as a pivot point to attack other internal network resources. Given the CVSS score of 9.1, this vulnerability is classified as critical and represents a significant risk to organizational data integrity and infrastructure security.

Immediate Action: Since a specific patch is currently unavailable, restrict access to the web management interface to trusted administrative IP addresses only. Disable the Virtual Volume management features if they are not strictly required for daily operations.

Proactive Monitoring: Monitor system logs for unusual HTTP POST requests directed at /cgi-bin/virtual_vol.cgi, particularly those containing shell metacharacters such as semicolons, pipes, or backticks. Inspect the device for the presence of unexpected files in the /tmp directory or unauthorized changes to system configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP POST requests that contain suspicious characters within the f_sharename, f_target, or f_name parameters.

Public Exploit Available: Yes, a technical write-up containing detailed reproduction steps and proof-of-concept payloads is publicly available via GitHub.

This vulnerability presents a severe risk due to the potential for remote code execution. Administrators should prioritize restricting network access to the management interface of affected D-Link devices immediately. Maintain vigilance for vendor updates and apply the necessary firmware patches as soon as they become available to permanently remediate this command injection flaw.