This vulnerability affects numerous D-Link DNS and DNR devices up to version 20260205. It arises from improper input validation in the cgi_check_rsync_rw function within the /cgi-bin/remote_backup.cgi script, allowing remote command injection via the 'ip' parameter. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed, increasing the risk of exploitation. However, no known exploits in the wild have been reported, and no vendor patch or fix has been documented.

Successful exploitation allows remote attackers to execute arbitrary commands on affected devices, potentially leading to full compromise of the device. This could impact device availability, confidentiality, and integrity. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. Despite public disclosure, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected devices' management interfaces, especially the /cgi-bin/remote_backup.cgi endpoint, from untrusted networks. Monitor vendor communications for updates on patches or mitigations.