Dns 322L Firmware EUVD-2026-18023

The CVSS 5.5 score with AV:N/AC:L/PR:N indicates a medium-severity vulnerability accessible to unauthenticated remote attackers with minimal effort. The CVSS 4.0 vector shows VC:L (low confidentiality impact) and E:P (proof-of-concept exists), confirming public exploitability. SSVC framework assessment: exploitation is confirmed public (E:P tag), attack is automatable (AC:L, no interaction required), and technical impact is limited to confidentiality (VC:L, no integrity or availability loss). Real-world risk is moderate rather than critical-the vulnerability enables unauthorized information disclosure on improperly configured or internet-exposed NAS devices but does not provide remote code execution or system takeover. However, the combination of public POC availability, lack of authentication requirements, and broad device model range (18+ affected models) elevates practical risk for unpatched deployments. Organizations exposing D-Link NAS devices to untrusted networks should prioritize remediation. The limited impact scope (confidentiality only) and absence of KEV status suggest this is not a nation-state or widespread active-exploitation priority, though targeted attacks against specific organizations are plausible.

An attacker identifies a D-Link DNS-323 or similar device exposed to the internet via port scanning or shodan-style enumeration. Without authentication, the attacker sends a crafted HTTP request to /cgi-bin/file_center.cgi with a malicious cmd parameter value, exploiting the improper access control in the Webdav_Access_List function. The server processes the request and returns sensitive file metadata or directory listings that should only be accessible to authorized users, enabling the attacker to identify valuable data or enumerate storage contents. Public exploit code (referenced in GitHub) simplifies this attack, requiring minimal technical skill to execute at scale against multiple unpatched devices.