This vulnerability affects various D-Link NAS devices up to firmware version 20260205. It arises from improper access controls in multiple functions of the /cgi-bin/dsk_mgr.cgi script, such as FMT_restart, Status_HDInfo, SMART_List, and others related to disk and RAID management. The flaw allows an unauthenticated remote attacker to manipulate these functions, potentially leading to unauthorized access or control over device operations. The CVSS 4.0 base score is 6.9, indicating a medium severity level. Exploit code is publicly available, but no vendor advisory or patch information is currently provided.

An unauthenticated remote attacker can exploit this vulnerability to bypass access controls on critical disk management functions of affected D-Link NAS devices. This could lead to unauthorized information disclosure or manipulation of device storage management features. The availability of public exploit code increases the likelihood of exploitation, although no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices, especially to the management interface, to trusted networks only. Monitor for unusual activity related to disk management functions. Avoid exposing these devices directly to untrusted networks.