The vulnerability is an OS command injection flaw in the file‑management functions delete/rename/copy/move/chmod/chown of the /cgi‑bin/webfile_mgr.cgi script on D‑Link DNS‑320 routers. An attacker can construct HTTP requests that cause the web server to execute arbitrary operating‑system commands with the web server’s privileges. This permits remote code execution on the device and can be leveraged for full control of the router and the network it serves. The CVSS score of 5.1 reflects moderate severity; the exploit is publicly available, the endpoint is reachable via the web interface, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, but public availability indicates a realistic risk of exploitation, especially for devices left exposed on the internet.

D‑Link DNS‑320 devices running firmware version 2.06B01. The flaw is limited to the webfile_mgr.cgi functionality exposed through the standard web administration interface of this firmware release.

With a CVSS of 5.1, the risk is moderate but tangible because the flaw permits remote code execution once an attacker can reach the router’s web interface. The exploit is known and publicly released, so administrators should treat the vulnerability as a high priority for remediation. The lack of a KEV listing does not mitigate the risk, as the public exploit can be used against any exposed device that still runs the affected firmware.