This vulnerability in D-Link DNS-320 2.06B01 involves OS command injection via the functions cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, and cgi_upnp_edit within the /cgi-bin/network_mgr.cgi script. Remote attackers can manipulate input to execute arbitrary OS commands on the device. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low complexity, and no user interaction required. No official patch or vendor advisory is available to confirm remediation status.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially compromising device integrity and confidentiality. The vulnerability affects a specific firmware version (2.06B01) of the D-Link DNS-320. Although exploits are publicly available, there is no indication of widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity related to the affected CGI functions. Avoid exposing the device management interface directly to untrusted networks.