Dnr 202l CVE-2026-5215

This vulnerability presents a moderate real-world risk despite the modest CVSS score of 4.3. The attack vector is adjacent network (AV:A), which restricts attackers to the local network segment-a realistic constraint in corporate or institutional environments where network segmentation is limited. However, multiple risk factors elevate concern: publicly available exploit code (POC) removes the barrier to weaponization, the CVSS vector indicates unauthenticated access (PR:N) with low complexity (AC:L), and the proof-of-exploitation rating (E:P) reflects known working exploits. The confidentiality impact (C:L) is low, but this appears to be information disclosure rather than arbitrary code execution. The widespread affected device list (18+ models) increases the total population at risk. SSVC decision framework signals: exploitation is active (POC available), the vulnerability is not highly automatable due to network adjacency requirements, but technical impact is elevation of privilege/information disclosure. Priority should be determined by device deployment density in sensitive network segments-devices exposed directly on corporate networks warrant higher priority than devices on isolated storage networks.

An attacker on the same local network segment (corporate LAN, shared office WiFi, or adjacent VLAN) without authentication credentials sends HTTP requests to the target D-Link NAS device at /cgi-bin/network_mgr.cgi with parameters targeting the cgi_get_ipv6 function. The improper access controls allow the request to succeed and return IPv6 configuration information including network settings, routing configuration, or other sensitive parameters that would normally require administrative authentication. This information can be used for network reconnaissance to identify additional targets, plan lateral movement, or understand network topology for a subsequent compromise. Public exploit code published on GitHub (referenced in the advisory) lowers the technical barrier, allowing even less skilled attackers to execute the attack with standard HTTP tools.