A command injection flaw was discovered in the /cgi-bin/account_mgr.cgi script used by many D‑Link router models. The vulnerability resides in several CGI functions, including cgi_chg_admin_pw, and allows a remote attacker to inject arbitrary shell commands into the device’s operating system. This gives the attacker the ability to execute commands on the appliance, which could lead to a compromise of the device’s internal state. The weakness is categorized as CWE‑74 and CWE‑77. The listed description states that the attack can be performed remotely; however, the overall impact on confidentiality, integrity, and availability is not explicitly quantified in the provided data, so we limit the impact statements to the explicitly stated remote code execution capability.

Devices affected include D‑Link models DNS‑120, DNR‑202L, DNS‑315L, DNS‑320, DNS‑320L, DNS‑320LW, DNS‑321, DNR‑322L, DNS‑323, DNS‑325, DNS‑326, DNS‑327L, DNR‑326, DNS‑340L, DNS‑343, DNS‑345, DNS‑726‑4, DNS‑1100‑4, DNS‑1200‑05, and DNS‑1550‑04. Firmware versions up to 20260205 are vulnerable, as specified in the description. The listed CNA product list confirms that these models are impacted.

The CVSS base score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low current exploitation probability. The vulnerability is not included in the CISA KEV catalogue. Exploit code is publicly available, and the description notes that the attack is possible from a remote location through the vulnerable CGI endpoints. Given the moderate severity and low exploitation likelihood, the risk is considered moderate, but the potential for remote command execution warrants timely action.