This vulnerability in D-Link DNS-320 2.06B01 involves OS command injection via the /cgi-bin/webfile_mgr.cgi endpoint. The affected functions—delete, rename, copy, move, chmod, and chown—do not properly sanitize input, enabling remote attackers with high privileges to execute arbitrary operating system commands. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), indicating network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or remediation level has been disclosed.

Successful exploitation allows remote attackers with high privileges to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact is rated medium severity with limited confidentiality, integrity, and availability consequences as per the CVSS vector. The exploit being publicly available increases the likelihood of attacks, but no known widespread exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected device's management interface to trusted networks and users with high privileges. Monitor for unusual activity related to file management functions on the device. Avoid exposing the device management interface directly to untrusted networks.