The vulnerability is a command injection flaw in the gui_mgr.cgi script, specifically in the cgi_mycloud_auto_downlaod endpoint. By manipulating the f_user argument, an attacker can inject arbitrary shell commands. The flaw is classified as CWE‑74 (Improper Neutralization of Special Elements used in an OS Command) and CWE‑77 (Improper Command Injection). Remote exploitation is possible, allowing an attacker to execute commands with the privileges of the web service, potentially leading to full system compromise.

Affected devices include a broad range of D‑Link routers and firewalls: DNS‑1100‑4, DNS‑120, DNS‑1200‑05, DNS‑1550‑04, DNS‑315L, DNS‑320, DNS‑320L, DNS‑320LW, DNS‑321, DNS‑323, DNS‑325, DNS‑326, DNS‑327L, DNS‑340L, DNS‑343, DNS‑345, DNS‑726‑4, DNR‑202L, DNR‑322L, and DNR‑326. All firmware releases up to 20260205 contain the vulnerable cgi_myfavorite_* and cgi_mycloud_auto_downlaod functions in /cgi-bin/gui_mgr.cgi.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is below 1 %, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers typically target the web‑based admin interface over HTTP or HTTPS, crafting requests to the vulnerable CGI script to inject commands. Because the flaw allows remote command execution, it poses a significant risk if the management interface is exposed to the internet.