D-Link DNS-320 EUVD-2026-46143

No special conditions are required - the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms remote unauthenticated exploitation against the DNS-320 web interface with no user interaction needed. The sole limiting factor is network accessibility: the device's HTTP management port must be reachable by the attacker, which applies to any unit with its management interface exposed to the internet or an untrusted network segment. Exploitation is constrained to devices running firmware 1.0.2 per reported data, though other versions sharing the same PHP handler may also be affected. No authentication, no specific configuration, and no victim interaction is required.

The assigned CVSS 4.0 score of 6.9 with impact metrics VC:L/VI:L/VA:L appears conservative for a CWE-434 flaw in a PHP application - this class of vulnerability typically enables full RCE via webshell upload, implying integrity impact should be higher. The discrepancy may reflect NVD's assessment that file execution from the upload path is not confirmed, but this should not be taken as definitively ruling it out. Offsetting the severity: D-Link DNS-320 is an older, likely end-of-life consumer NAS device, limiting the population of exposed assets. However, the public POC raises opportunistic exploitation risk for any unit exposed to the internet. No KEV listing means confirmed mass exploitation is not yet observed. EPSS data was not provided, so exploitation probability cannot be quantitatively anchored. The absence of a vendor patch and the EOL status of the product mean compensating controls are the primary recourse for most owners.

An attacker identifies a DNS-320 unit with its web interface reachable from the internet, sends a crafted HTTP POST request to /mydlink/multi_uploadify.php with a PHP webshell disguised in the Filedata[] parameter, and the device stores the file without type validation. The attacker then issues an HTTP GET request to the uploaded file's path on the device, triggering PHP execution and establishing interactive command-and-control over the NAS. A public proof-of-concept is available and has been referenced via a Feishu document, lowering the skill barrier for this attack.