D-Link DNS-320 OS Command Injection Vulnerability in network_mgr.cgi

An OS command injection vulnerability has been identified in the D-Link DNS-320 ShareCenter NAS, specifically in the firmware version 2.06B01 HOTFIX. The vulnerability resides in the network_mgr.cgi file, within eight functions that handle HTTP parameters. These parameters are read and then passed unsanitized to the system command via sprintf, allowing for remote command execution.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /cgi-bin/network_mgr.cgi endpoint. Include a valid session cookie and specify the command injection payload in the HTTP parameters. The injected command will be executed on the server.