This vulnerability involves a stack-based buffer overflow in the cgi_adduser_to_session function of the /cgi-bin/account_mgr.cgi script on multiple D-Link NAS devices. The issue arises from improper manipulation of the read_list argument, enabling remote attackers to overflow the stack. The affected devices include a broad range of D-Link NAS models up to firmware version 20260205. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on affected D-Link NAS devices. Given the stack-based buffer overflow nature, attackers may gain control over the device or disrupt its normal operation. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by D-Link, users should consider limiting network exposure of affected devices, such as restricting remote access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.