This vulnerability affects D-Link DNS-320 firmware version 1.0.2 and is caused by improper validation of the Filedata[] argument in the /mydlink/multi_uploadify.php script. This flaw allows an unauthenticated remote attacker to perform unrestricted file uploads, potentially leading to further compromise. The vulnerability is publicly known, but no vendor-provided fix or mitigation has been disclosed as of the publication date.

Successful exploitation allows remote attackers to upload arbitrary files to the device without authentication. This could lead to unauthorized code execution or other malicious activities depending on the uploaded content and device configuration. The CVSS score of 6.9 indicates a medium impact with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected device's management interface from untrusted networks and monitor for suspicious upload activity.