This vulnerability affects the D-Link DNS-320 device firmware version 2.06B01. It arises from improper input handling in several CGI functions (cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, cgi_upnp_edit) within the /cgi-bin/network_mgr.cgi file. An attacker can remotely exploit this flaw to inject arbitrary OS commands, potentially leading to unauthorized command execution on the device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vulnerability was published on May 11, 2026, with no vendor remediation or patch currently documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, which could compromise the device's integrity and potentially affect network operations. However, the CVSS score and vector suggest the impact on confidentiality, integrity, and availability is low to limited. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the device's management interface to trusted networks only and monitor for unusual activity. Avoid exposing the device's CGI interfaces to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.