This vulnerability involves a stack-based buffer overflow in the cgi_addgroup_get_group_quota_minsize function of the /cgi-bin/account_mgr.cgi script on affected D-Link NAS devices. The issue arises from improper validation of the 'Name' parameter, which can be manipulated remotely to overflow the stack buffer. This can lead to potential arbitrary code execution or denial of service. The vulnerability affects multiple D-Link NAS models up to firmware version 20260205. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. No vendor patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on affected D-Link NAS devices. The vulnerability impacts confidentiality, integrity, and availability of the device. There are no known exploits in the wild at this time, but a public exploit exists, increasing the risk of potential attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the affected devices' management interfaces to trusted users only and monitor for any suspicious activity targeting the vulnerable CGI endpoint. Avoid exposing these devices directly to untrusted networks.