This vulnerability in D-Link DNS series devices involves improper access control in the Webdav_Access_List function of the file_center.cgi script. By manipulating the cmd argument, an attacker can bypass intended access restrictions remotely. The issue affects a broad range of D-Link models and firmware versions up to 20260205. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and partial impact on confidentiality.

Successful exploitation allows a remote attacker to bypass access controls on affected D-Link devices, potentially enabling unauthorized access to device functions or data. The vulnerability does not require authentication or user interaction. The partial confidentiality impact suggests some sensitive information could be exposed. There is no indication of integrity or availability impact. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor D-Link's advisories for updates. Until a fix is available, restricting remote access to the affected devices' management interfaces and disabling WebDAV services if not needed may reduce exposure.