Multiple D-Link network storage devices are susceptible to an unauthenticated access control bypass that permits attackers to modify administrative configurations and execute unauthorized system commands.

This vulnerability resides in the cgi_set_wto function within /cgi-bin/system_mgr.cgi, where improper access controls allow an unauthenticated attacker to manipulate system settings. By sending specially crafted requests, an attacker can modify administrative accounts or trigger unauthorized device operations.

The ability for an unauthenticated attacker to gain persistent, privileged access to network-attached storage poses a severe risk to data confidentiality and integrity. Given the CVSS score of 7.3, this flaw enables unauthorized management of sensitive files and potential device takeover, leading to significant operational disruption and the potential for long-term data exfiltration.

Immediate Action: Since a specific patch is not currently identified, users should isolate affected D-Link NAS devices from the public internet immediately and restrict management interface access to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unexpected POST requests directed at /cgi-bin/system_mgr.cgi, particularly those invoking the cgi_set_wto or cgi_shutdown commands from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter incoming HTTP requests to the device web interface, specifically blocking unauthorized calls to the identified vulnerable CGI scripts.

Public Exploit Available: Yes, a proof-of-concept has been published in the researcher's technical write-up on GitHub.

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations must prioritize the mitigation of these devices. Administrators should ensure these units are not exposed to the internet and remain vigilant for vendor-released firmware updates that address the identified access control failures.