This vulnerability in D-Link DNS-320 firmware version 2.06B01 allows an attacker with high privileges to perform OS command injection via the webfile_mgr.cgi CGI script. The flaw affects multiple file management functions (delete, rename, copy, move, chmod, chown), enabling injection of arbitrary OS commands. The attack vector is remote network access with no user interaction required. The CVSS 4.0 base score is 5.1, reflecting medium severity with low attack complexity and no privileges required for attack initiation, but high privileges needed for exploitation.

Successful exploitation could allow an attacker with high privileges to execute arbitrary OS commands on the affected device remotely. This could lead to unauthorized control over the device, potentially compromising its confidentiality, integrity, and availability. However, the impact is limited by the requirement for high privileges and the lack of confirmed exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor D-Link's official channels for updates. Until a patch is available, restrict remote access to the device's management interface to trusted networks and users with appropriate privileges to reduce exposure.