Dnr 202l CVE-2026-5214

Requires: network access (remote), low-privilege authentication.

The CVSS base score of 8.8 (High) accurately reflects severe potential impact-complete compromise of confidentiality, integrity, and availability. However, real-world risk requires nuanced assessment. The CVSS vector reveals authentication is required (PR:L), meaning attackers need valid credentials before exploitation, significantly reducing attack surface compared to unauthenticated vulnerabilities. Attack complexity is low (AC:L) and no user interaction needed (UI:N), making exploitation straightforward once authenticated. The critical risk amplifier is public exploit availability: a detailed proof-of-concept exists on GitHub with step-by-step reproduction, eliminating research overhead for adversaries. The network attack vector (AV:N) enables remote exploitation without physical access. These D-Link NAS models are commonly deployed in small-to-medium business and home office environments, often with default or weak credentials and exposed management interfaces. The absence of CISA KEV listing suggests no confirmed large-scale active exploitation campaigns, but the public POC and aging device population (many models discontinued or approaching end-of-life) create persistent exposure. Organizations should prioritize this based on asset exposure: internet-facing devices with weak authentication represent critical risk; internal-only deployments with strong credential hygiene represent moderate risk. The exploitability metrics (E:P indicating proof-of-concept exists) and lack of remediation level data (RL:X) suggest vendor response may be limited for EOL products.

An attacker conducts reconnaissance against an organization's perimeter and discovers a D-Link DNS-320L NAS device with its web management interface exposed on port 80/443. Using credential stuffing with common default credentials or previously compromised passwords from corporate breaches, the attacker successfully authenticates to the account management interface. The attacker then crafts an HTTP request to /cgi-bin/account_mgr.cgi with an oversized Name parameter value (exceeding buffer capacity) containing shellcode designed to spawn a reverse shell. The vulnerable cgi_addgroup_get_group_quota_minsize function copies this malicious input into a fixed-size stack buffer without bounds checking, overwriting the saved return address. When the function returns, execution redirects to attacker-controlled shellcode, granting command execution as the web server user (typically root or administrator-equivalent on embedded NAS devices). The attacker establishes persistence, exfiltrates sensitive file shares, and pivots to internal network resources using the compromised NAS as a beachhead. The publicly available GitHub POC at https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_169/169.md provides step-by-step exploitation instructions, making this scenario accessible to attackers with moderate technical skill.