D-Link DNS/DNR NAS CVE-2026-16448

Exploitation requires network access to the device's web management interface and a valid user account with at least low-privilege access (PR:L per CVSS 4.0 vector). The vulnerable code path is specifically the remote backup CGI endpoint (/cgi-bin/remote_backup.cgi), so the rsync/remote backup feature must be reachable - this is part of the standard web UI on affected devices rather than a separately enabled feature. Exploitation is limited by the authentication requirement: unauthenticated attackers cannot directly reach the vulnerable function without first obtaining credentials. Default or weak credentials on D-Link NAS devices (common in consumer/SMB deployments) significantly reduce this barrier in practice. No specific non-default configuration is required beyond having a user account.

The CVSS 4.0 score of 5.3 with PR:L signals that exploitation requires at least low-privilege authenticated access, which materially limits the attack surface compared to unauthenticated network exploitation. The low vulnerable-system impact metrics (VC:L/VI:L/VA:L) in the provided CVSS 4.0 vector appear conservative for a command injection primitive - command injection on embedded Linux typically yields OS-level access, suggesting the CGI process may run in a restricted context. EPSS data was not provided in the input; no KEV listing is present, so active exploitation is not confirmed. However, a proof-of-concept is publicly available (E:P in the CVSS 4.0 supplemental metric), lowering the bar for exploitation. The most significant real-world risk factor is the EOL status of many affected models: D-Link historically does not backport patches to discontinued hardware, leaving deployed devices permanently vulnerable. The combination of a public POC and an unpatched embedded device accessible over the network represents a meaningful long-term exposure for owners who cannot replace hardware.

An attacker with a valid low-privilege account on the D-Link NAS (or who has obtained such credentials through credential stuffing or default password use) sends a crafted POST request to /cgi-bin/remote_backup.cgi with the 'ip' argument containing shell metacharacters and injected commands. Because the cgi_check_rsync_rw function builds a shell command incorporating the unsanitized input, the injected commands execute in the context of the CGI process on the device. A public proof-of-concept demonstrating this technique is available via the Feishu document referenced in the CVE.