This vulnerability affects D-Link DNS-320 firmware version 2.06B01 and is caused by improper input handling in the cgi_set_host, cgi_set_ntp, cgi_fan_control, and cgi_merge_user functions of the /cgi-bin/system_mgr.cgi script. An attacker with high privileges can remotely inject OS commands, potentially leading to unauthorized command execution on the device. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows a remote attacker with high privileges to execute arbitrary OS commands on the affected device, potentially compromising the system's integrity and availability. The impact on confidentiality, integrity, and availability is rated as low to limited. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected device's management interface to trusted networks and users with appropriate privileges. Monitor for any updates from D-Link regarding patches or mitigations.