Dsm G600
Monthly
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.