This vulnerability arises from a command injection flaw in the unknown "wizard_mgr.cgi" function exposed via the /cgi-bin path on affected D-Link devices. A malicious actor can send a crafted HTTP request to the wizard_mgr.cgi endpoint and cause the device to execute arbitrary shell commands. The injection weakness is identified as CWE-74 (Command Injection: Argument) and CWE-77 (Command Injection: OS Command injection). Successful exploitation permits an attacker to read, modify, or delete data on the device, potentially leading to full device compromise, unauthorized network access, or service disruption. The CVSS score of 5.3 reflects a moderate severity, indicating significant impact when exploited.

The flaw affects multiple D-Link models, specifically: DNR-202L, DNR-322L, DNR-326, DNS-1100-4, DNS-120, DNS-1200-05, DNS-1550-04, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-343, DNS-345, and DNS-726-4. These devices are vulnerable when running firmware versions up to the release dated 20260205. No precise version range is provided; all devices listed are considered affected until a patch is applied.

The overall risk is moderate, reflected by the CVSS score of 5.3, with a low EPSS probability (3%) suggesting limited observed exploitation. However, the vulnerability is not listed in the CISA KEV catalog, yet published exploit code is available online. Attackers can exploit the flaw remotely over the network by issuing HTTP requests that trigger the wizard_mgr.cgi script, without requiring user interaction. Given the public availability of the exploit and the potential for complete device compromise, the recommended approach is to apply the vendor’s firmware update immediately to mitigate the risk.