The vulnerability permits an attacker to execute arbitrary shell commands via the cgi_ntp_time function in the /cgi-bin/system_mgr.cgi file on affected D‑Link devices. The flaw originates from improperly handling input parameters, leading to command injection (CWE-74) and improper restriction of operations within a command (CWE-77). An attacker can exploit this remotely without authentication, potentially gaining full control over the router, compromising confidentiality, integrity, and availability of network resources.

The affected products include D-Link DNR‑202L, DNR‑326, DNR‑322L, DNS‑1100‑4, DNS‑120, DNS‑1200‑05, DNS‑1550‑04, DNS‑315L, DNS‑320, DNS‑320L, DNS‑320LW, DNS‑321, DNS‑323, DNS‑325, DNS‑326, DNS‑327L, DNS‑340L, DNS‑343, DNS‑345, DNS‑726‑4 and related firmware releases up to build 20260205. Any firmware version released on or before that date may be vulnerable.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation can occur from any host that can reach the device’s management interface, requiring no credentials. Since the exploit code is publicly disclosed, unpatched devices are susceptible to remote command injection attacks.