Executive brief
A vulnerability exists in the D-Link DNS-320 ShareCenter, a network-attached storage (NAS) device used for data backup and file sharing. An attacker with administrative access can execute unauthorized system commands on the device. This could lead to a complete compromise of the storage system, allowing the attacker to view, modify, or delete sensitive files and disrupt network operations.
Technical details
Multiple OS command injection vulnerabilities exist within the /cgi-bin/network_mgr.cgi binary of the D-Link DNS-320 firmware. The root cause is the improper neutralization of special elements; specifically, the application uses cgiFormString() to read HTTP parameters and passes them unsanitized to the system() function via sprintf(). Affected functions include cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, and cgi_upnp_edit. While the attack is reachable over the network, it typically requires high privileges (administrative session) to exploit. Successful exploitation allows for full remote code execution (RCE) on the underlying Linux operating system.
Affected products
- D-Link DNS-320 ShareCenter NAS (Rev.A) Firmware 2.06B01 HOTFIX
Timeline
- 2026-05-11: advisory: NVD publication date