A vulnerability was discovered in the download manager of multiple D-Link DNS and DNR devices, specifically in the RSS_Item_List function of /cgi-bin/download_mgr.cgi. The flaw permits an attacker to inject arbitrary operating‑system commands via crafted input, which can be executed remotely. This leads to a loss of confidentiality, integrity, and availability of the affected device and the network it serves, corresponding to the CWE‑77 "Command Injection" weakness (also CWE‑74 "Error Reporting Vulnerability" is listed as an associated weakness).

Affected products include all D-Link devices listed in the CNA data: D-Link:DNR-202L, D-Link:DNR-322L, D-Link:DNR-326, D-Link:DNS-1100-4, D-Link:DNS-120, D-Link:DNS-1200-05, D-Link:DNS-1550-04, D-Link:DNS-315L, D-Link:DNS-320, D-Link:DNS-320L, D-Link:DNS-320LW, D-Link:DNS-321, D-Link:DNS-323, D-Link:DNS-325, D-Link:DNS-326, D-Link:DNS-327L, D-Link:DNS-340L, D-Link:DNS-343, D-Link:DNS-345, D-Link:DNS-726-4. Firmware versions up to 20260205 contain the flaw; all later releases are assumed to be patched.

The CVSS v3.1 score of 5.3 indicates moderate severity. The EPSS probability is less than 1 %, suggesting a low likelihood of widespread exploitation at this time, and the issue is not listed in the CISA KEV catalog. Exploitation requires remote access to the device’s download_mgr.cgi endpoint; depending on device configuration, the attack may be possible over an unauthenticated HTTP request or an authenticated session. No specific exploitation conditions beyond reaching the endpoint are noted in the description.