This vulnerability affects D-Link DNS-320 version 1.0.2 and is caused by improper validation of the Filedata[] argument in the /mydlink/multi_uploadify.php file, leading to unrestricted file upload. This allows an unauthenticated remote attacker to upload arbitrary files to the device, potentially enabling further compromise. The CVSS 4.0 base score is 6.9, reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The exploit is publicly known, but no official fix or mitigation has been documented.

An attacker can remotely upload arbitrary files to the affected device without authentication, which may lead to unauthorized code execution or other malicious activities depending on the uploaded content. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device and disabling remote upload features if possible may reduce exposure.