D-Link DSM-G600 CVE-2026-82680

Exploitation requires low-privilege authentication on the D-Link DSM-G600 (PR:L per the CVSS 4.0 vector), meaning the attacker must hold valid credentials - this could be factory-default credentials, a guest account, or any user account on the device. The device's web interface must be reachable over the network (AV:N). No specific non-default configuration is required; the /load_file.cgi endpoint and its Multipart Handler appear to be standard components of firmware 1.01. Limiting exploitation: the PR:L requirement means unauthenticated network exploitation is not indicated by the available data; attackers must first obtain credentials. The device is legacy hardware with a limited installed base, which naturally constrains opportunistic targeting.

The CVSS 4.0 score of 7.4 reflects a network-exploitable flaw with high confidentiality, integrity, and availability impact but requires low-level authentication (PR:L), which moderates the raw score. No EPSS data was supplied, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. However, the public availability of exploit code (E:P confirmed in CVSS 4.0 supplemental metrics and by VulDB reporting) meaningfully elevates real-world risk beyond what the score alone implies. The DSM-G600 is legacy D-Link NAS hardware with no active vendor support, making patching effectively impossible through official channels; defenders managing any surviving units - even in small-office or home environments - should treat decommissioning or network isolation as the primary response. The absence of KEV listing should not be read as safety: PoC availability on unpatched embedded devices with weak authentication postures historically converts to exploitation quickly.

An attacker with low-privilege credentials on the D-Link DSM-G600 (e.g., a guest account or default credentials left unchanged) sends a crafted HTTP multipart/form-data POST request to /load_file.cgi containing a malformed Content-Disposition or oversized boundary segment. The Multipart Handler writes beyond an allocated buffer, corrupting adjacent memory structures and enabling the attacker to redirect execution to attacker-controlled code. A public PoC demonstrating this technique is available in the referenced GitHub repository (https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-BOF-001-vulndb.md).