The vulnerability allows an attacker to inject arbitrary operating‑system commands through the cgi_upnp_edit function in /cgi-bin/network_mgr.cgi. Successful exploitation results in remote code execution on the D‑Link DNS‑320 device, enabling the attacker to read, modify, or delete data, install malware, or take complete control of the device. The weakness is classified as OWASP CWE‑77 and CWE‑78, reflecting classic command‑injection and operating‑system command execution flaws. This could compromise the confidentiality, integrity, and availability of the device and any network services it hosts.

D‑Link DNS‑320 routers running firmware version 2.06B01 are affected. The issue resides in several CGI handlers—including cgi_speed, cgi_dhcpd_lease, cgi_ddns, cgi_set_ip, cgi_upnp_del, cgi_dhcpd, cgi_upnp_add, and cgi_upnp_edit—within the network_mgr.cgi script accessed via the router’s web interface.

The flaw is reachable over the network; an attacker can invoke it remotely by sending specially crafted HTTP requests to the vulnerable CGI scripts. While the publicly documented exploits are available, the CVSS score of 5.1 indicates moderate severity, and no EPSS score suggests limited exploitation probability so far. The vulnerability is not listed in the CISA KEV catalog, but because it permits unrestricted command execution on a home‑network router, it remains a significant risk for systems where management access is exposed to untrusted networks.