CVE-2026-8271 — D-Link DNS-320 2.06B01 Command Injection

title: CVE-2026-8271 - D-Link DNS-320 Network Mgr CGI Command Injection
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-8271 by targeting the network_mgr.cgi script in D-Link DNS-320 devices. The rule looks for requests to the specific cgi-bin script and queries containing known vulnerable functions combined with common command injection characters or syntax.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8271/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cgi-bin/network_mgr.cgi'
      cs-uri-query|contains:
          - 'cgi_speed'
          - 'cgi_dhcpd_lease'
          - 'cgi_ddns'
          - 'cgi_set_ip'
          - 'cgi_upnp_del'
          - 'cgi_dhcpd'
          - 'cgi_upnp_add'
          - 'cgi_upnp_edit'
      cs-uri-query|contains:
          - '`'
          - ';'
          - '|'
          - '$'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse