CVE-2018-25120 is a critical (CVSS 9.8) command injection in the Mail Test function of D-Link DNS-343 ShareCenter storage devices running firmware up to 1.05. An unauthenticated attacker can run commands as root. D-Link has declared the product line end of life, so plan to replace the device.
What's affected
D-Link DNS-343 ShareCenter, firmware versions up to and including 1.05, per the record and VulnCheck. The product line has been declared end of life.
The flaw is in the Mail Test function. The record says the maintenance script posts to the internal goForm endpoint /goform/Mail_Test and uses several form parameters directly in a call to a system email utility without input validation, so injected shell commands run as root.
VulnCheck's advisory also notes that the issue appears in the VulnCheck KEV database. The CISA KEV flag in our record is false, so that is the only exploitation signal here and it comes from VulnCheck. No fixed firmware is confirmed.
How to check if you're exposed
Open the device's web interface and read the firmware version. 1.05 or earlier is in scope, and so is any DNS-343 whose firmware you cannot read.
Then check whether it is reachable from outside. A NAS should almost never be:
nmap -p 80,443,8080 <nas-public-address>
Test only addresses you own. Check your router for port forwards that point at the NAS, and check whether any cloud relay feature exposes it.
Network storage often holds backups and shared files, so review what is stored on the device and who can reach it.
What to do now
- Find every DNS-343 on your networks.
- Remove it from the internet. No port forwarding, no remote access features.
- Copy the data to a supported storage system, then retire the device.
- Treat anything the NAS could reach, such as mounted shares and stored credentials, as potentially exposed and rotate secrets.
- Restrict access to the admin page to a single management host while the device remains in use.
Why it matters
The class is CWE-78 (OS Command Injection). A mail test feature builds an email command from form fields. Without validation, a field value can end the intended command and begin another one. The device runs its web service as root, so the injected command does too.
An end of life storage device is a risky combination: it holds valuable data, it cannot be patched and it often sits on a flat network. The practical fix is migration. Moving the data to a supported system removes the vulnerable code from your estate.
The record does not mark this CVE as CISA KEV. VulnCheck lists it in its own KEV database, and public exploit material is referenced.
Quick check
Is there a firmware update?
The product line is end of life and no fixed firmware is confirmed. Plan to migrate the data and retire the device.
Is this in the CISA KEV catalog?
No. The record flag is false. VulnCheck notes that it is in the VulnCheck KEV database.
Sources
Last reviewed: 19 October 2026.
