Dnr 202l EUVD-2026-17613

Requires: network access (remote), low-privilege authentication.

Real-world exploitation risk is significant despite requiring authentication (PR:L). The CVSS vector shows network attack vector (AV:N), low complexity (AC:L), no user interaction required (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), yielding an 8.8 base score. Critically, publicly available exploit code exists (E:P status confirmed, GitHub repository linked in references), substantially lowering the barrier to exploitation. However, no CISA KEV listing suggests large-scale active exploitation has not been observed in critical infrastructure contexts. The SSVC framework would classify this as high technical impact (arbitrary code execution on network storage), low-to-moderate automatable potential (requires valid credentials but documented exploit simplifies automation), and exploitation status of POC-available. The requirement for low-privilege authentication provides minimal protection given common credential reuse, default passwords, and the exposed nature of NAS web interfaces. The vulnerability's age (affecting firmware through early 2026 but reported on legacy hardware) and D-Link's history of ending support for older NAS models suggests many deployments may remain permanently vulnerable. Organizations using affected models face realistic compromise risk from opportunistic attackers scanning for exposed NAS interfaces with weak credentials.

An external attacker conducts reconnaissance scanning for D-Link NAS devices with exposed web interfaces, identifying vulnerable models through HTTP banner fingerprinting or login page characteristics. Using credential stuffing or exploiting default/weak passwords (satisfying the PR:L requirement), the attacker authenticates to the web management interface and navigates to the UPnP server configuration accessible via /cgi-bin/app_mgr.cgi. Leveraging the publicly available exploit code from GitHub, the attacker crafts a malicious HTTP request with an oversized f_dir parameter value designed to overflow the stack buffer in UPnP_AV_Server_Path_Del function, overwriting the return address to redirect execution to attacker-controlled shellcode. Successful exploitation grants the attacker arbitrary code execution with web server privileges, enabling installation of persistent backdoors, exfiltration of sensitive files stored on the NAS, lateral movement to other network resources accessible from the compromised device, or deployment of ransomware to encrypt stored data.