CVE-2026-8272 — D-Link DNS-320 2.06B01 Command Injection

title: CVE-2026-8272 - D-Link DNS-320 webfile_mgr.cgi Command Injection
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-8272 by targeting the webfile_mgr.cgi script on D-Link DNS-320 devices. The rule looks for specific URI paths and query parameters indicative of directory traversal and command injection attempts, often used to execute arbitrary commands on the affected device.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8272/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cgi-bin/webfile_mgr.cgi'
      cs-uri-query|contains:
          - '..%2F..%2F'
          - '..%2F..%252F'
          - '..%252F..%252F'
      cs-method|contains:
          - 'POST'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse