A vulnerability in the network manager CGI module allows attackers to retrieve IPv6 configuration information without proper authorization because the cgi_get_ipv6 function implements insecure permissions (CWE‑266) and improper authorization controls (CWE‑284). As a result, unauthenticated users can read sensitive network details, enabling an attacker to gain visibility into the device’s network setup and potentially use that information for further reconnaissance. The flaw does not provide direct code execution but exposes confidential configuration data that could aid in a targeted attack against the connected network.

The flaw affects multiple D‑Link router models, including the DNS‑120, DNS‑1550‑04, DNS‑315L, DNS‑320, DNS‑320L, DNS‑320LW, DNS‑321, DNS‑323, DNS‑325, DNS‑326, DNS‑327L, DNS‑340L, DNS‑343, DNS‑345, DNS‑726‑4, DNS‑1100‑4, DNS‑1200‑05, and other R‑Series firmware up to the 20260205 release. Any device running those firmware versions is vulnerable until a newer release resolves the improper access control.

With a CVSS score of 5.3 and an EPSS rate below 1%, the overall risk is moderate, and the likelihood of exploitation is low, although the vulnerability is publicly available. The attack vector is likely remote, performed over the device’s HTTP interface targeting the /cgi‑bin/network_mgr.cgi endpoint, and does not require authentication due to the missing permissions checks. No CISA KEV listing indicates that it has not yet been widely exploited, but defenders should assume the possibility and secure the affected interfaces.