This vulnerability in D-Link DNS-320 2.06B01 involves OS command injection through multiple CGI functions in the system_mgr.cgi script. An attacker can remotely manipulate inputs to cgi_set_host, cgi_set_ntp, cgi_fan_control, or cgi_merge_user, causing arbitrary OS commands to be executed. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no user interaction, and requiring high privileges. No official remediation or patch has been documented yet.

Successful exploitation could allow an attacker with high privileges to execute arbitrary operating system commands remotely on the affected device. This could lead to unauthorized control or disruption of the device's operation. However, exploitation requires high privileges, and the impact is rated medium severity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interface to trusted users only and monitor for suspicious activity targeting the vulnerable CGI endpoints.