CVE-2026-8273 — Command Injection

title: CVE-2026-8273 - D-Link DNS-320 Command Injection via cgi-bin
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-8273 by targeting the /cgi-bin/system_mgr.cgi script on D-Link DNS-320 devices. The rule specifically looks for requests containing the vulnerable CGI functions (cgi_set_host, cgi_set_ntp, cgi_fan_control, cgi_merge_user) in the URI query, combined with characters indicative of command injection (backticks, semicolons, pipes, double ampersands, double pipes). This is a direct indicator of an attempt to exploit this command injection vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8273/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri:
          - '/cgi-bin/system_mgr.cgi'
      cs-uri-query|contains:
          - 'cgi_set_host'
          - 'cgi_set_ntp'
          - 'cgi_fan_control'
          - 'cgi_merge_user'
      cs-uri-query|contains:
          - '`'
          - ';'
          - '|'
          - '&&'
          - '||'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse