D-Link DNS-320 EUVD-2026-29029

Exploitation requires high-privilege administrative authentication to the D-Link DNS-320 web interface - this is not unauthenticated remote exploitation. The attacker must have valid admin credentials or session token to submit requests to /cgi-bin/network_mgr.cgi. No special device configuration beyond standard NAS deployment is required; any D-Link DNS-320 with firmware 2.06B01 running the vulnerable CGI scripts is at risk if admin access is compromised. Network accessibility (AV:N) applies only post-authentication; external attackers without admin credentials cannot exploit this directly from the internet without first gaining valid credentials or bypassing authentication. The vulnerability is triggered when any of the eight vulnerable CGI parameters (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit) receive unsanitized input containing shell metacharacters or command separators.

CVSS 4.0 (PR:H/AV:N) indicates high privilege requirement, which significantly constrains real-world exploitation. The CVSS vector shows limited impact (VC:L/VI:L/VA:L with no scope change), suggesting the attacker gains only limited confidentiality, integrity, and availability impact within the application context. However, the presence of publicly available exploit code (POC:YES) and documented command injection primitives elevate practical risk for authenticated administrators with malicious intent or compromised admin credentials. The E:P (exploit maturity: proof-of-concept) designation aligns with the GitHub repository containing working payloads. Key tension: network accessibility (AV:N) combined with command injection (CWE-78) creates high theoretical privilege escalation potential if an attacker obtains admin credentials, but CVSS score (2.0) does not reflect this because the scoring assumes the attacker is already authenticated and inside the trust boundary. This is not a high-priority vulnerability for external threat actors lacking admin access, but is critical for insider threats or lateral movement scenarios where admin credentials are compromised.

An attacker with valid administrative credentials (obtained through credential compromise, phishing, or insider threat) sends a crafted HTTP POST request to /cgi-bin/network_mgr.cgi with OS command injection payload in one of the vulnerable parameters (e.g., cgi_set_ip with shell metacharacters). The parameter is passed to a system command executor without sanitization, allowing execution of arbitrary commands with the privileges of the web server process on the NAS device. The attacker could exfiltrate data, pivot to other systems on the network, or modify device configuration.