Dnr 202l EUVD-2026-17663

Requires: network access (remote), low-privilege authentication.

This vulnerability presents elevated real-world risk despite requiring authentication (PR:L). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 with network attack vector, low complexity, and complete confidentiality/integrity/availability impact. Critically, publicly available exploit code exists (E:P confirmed in CVSS temporal metrics and GitHub POC reference), dramatically lowering the barrier for exploitation. Authentication requirements are minimal-low-privilege credentials suffice, which may be obtainable through credential stuffing, default credentials, or prior compromise. The affected devices are network-attached storage systems often exposed to local networks or internet-facing for remote access, expanding attack surface. No CISA KEV listing indicates no confirmed mass exploitation campaigns yet, but the combination of public exploit, network accessibility, authentication bypass potential via default credentials, and complete system impact makes this a priority for organizations running affected D-Link NAS devices. EPSS data not provided, but technical factors suggest moderate-to-high exploitation probability.

An attacker identifies an internet-exposed D-Link DNS-320L NAS device through Shodan reconnaissance, discovering the default web interface on port 80. Using commonly documented default credentials or credentials obtained from credential dumps, the attacker authenticates with low-privilege user access. Leveraging the publicly available GitHub proof-of-concept exploit, they craft a malicious HTTP request to /cgi-bin/account_mgr.cgi with an oversized read_list parameter containing shellcode. The stack-based buffer overflow overwrites the return address, redirecting execution to attacker-controlled code that establishes a reverse shell with root privileges, granting complete control over the NAS device and stored data.