This vulnerability affects a range of D-Link NAS devices up to firmware version 20260205. The issue lies in the UPnP_AV_Server_Path_Del function of the /cgi-bin/app_mgr.cgi endpoint, where manipulation of the f_dir argument leads to a stack-based buffer overflow. The vulnerability is remotely exploitable without authentication or user interaction, allowing attackers to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although an exploit is publicly available, no patch or official fix has been documented yet.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service on affected D-Link NAS devices. The vulnerability requires no privileges or user interaction, making it highly accessible to attackers. The published exploit increases the likelihood of active exploitation attempts. The impact is significant given the potential for full device compromise or disruption of NAS services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the affected devices, especially blocking access to the /cgi-bin/app_mgr.cgi endpoint from untrusted networks. Disable UPnP services if not required. Monitor vendor communications for updates and apply patches promptly once released.