The vulnerability resides in the system_mgr.cgi CGI on the D-Link DNS‑320 router. By supplying crafted input to functions such as cgi_set_host, cgi_set_ntp, cgi_fan_control, or cgi_merge_user, an attacker can inject arbitrary operating‑system commands. This enables the execution of unintended commands on the device, potentially giving an attacker a shell or full control of the router. Because the flaw can be triggered remotely, it poses a risk to the confidentiality, integrity, and availability of the device and any network it serves.

Affected system is the D-Link DNS‑320 NAS/router running firmware version 2.06B01. The flaw exists in the cgi_set_host, cgi_set_ntp, cgi_fan_control, and cgi_merge_user CGI scripts located in /cgi-bin/system_mgr.cgi. No other products or versions were listed.

The CVSS score of 5.1 indicates medium severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. The weakness belongs to command injection and can be exploited remotely over the device’s web interface; the CGI functions appear to accept unauthenticated or default credentials. The attack vector is therefore remote and requires network access to the management interface.