This vulnerability involves improper access controls in the cgi_get_ipv6 function of the /cgi-bin/network_mgr.cgi script on various D-Link DNS devices. The flaw allows unauthorized users to bypass intended access restrictions, potentially exposing device configuration or network information. The vulnerability affects multiple models including DNS-120, DNS-320, DNS-323, DNS-340L, DNS-345, and others up to firmware version 20260205. The CVSS 4.0 base score is 5.3, indicating medium severity with attack vector as adjacent network and no privileges or user interaction required. Exploit code is publicly available, increasing the risk of exploitation, although no active exploitation has been reported.

The vulnerability could allow an attacker on the adjacent network to bypass access controls and potentially retrieve sensitive network or device configuration information via the vulnerable CGI function. This may lead to unauthorized information disclosure or further attacks leveraging the exposed data. However, there is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been referenced, users should monitor D-Link's advisories for updates. Until a fix is available, restricting access to the device management interface to trusted networks and users is recommended to reduce exposure.