A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices allows remote authenticated attackers to compromise system stability and potentially execute arbitrary code.

This vulnerability is a stack-based buffer overflow located in the UPnP_AV_Server_Path_Setting function within the /cgi-bin/app_mgr.cgi binary. By sending a crafted, overly long f_dir parameter, an attacker with low-level authenticated access can override the function return address, leading to a crash or arbitrary code execution.

Successful exploitation of this vulnerability can lead to a complete denial of service for the affected network-attached storage device, resulting in data unavailability and operational disruption. Furthermore, because the flaw allows for potential arbitrary code execution, an attacker could gain unauthorized control over the device, leading to a compromise of sensitive stored data or lateral movement within the network. The CVSS score of 8.8 reflects the high severity of this remote code execution risk.

Immediate Action: Update the affected D-Link NAS devices to the latest firmware version released after 20260205, as this includes the necessary security patches to address the overflow.

Proactive Monitoring: Monitor access logs for the /cgi-bin/app_mgr.cgi endpoint, specifically looking for POST requests containing abnormally large f_dir parameter strings or unexpected administrative activity.

Compensating Controls: Implement strict network access control to ensure only trusted administrative accounts can reach the management interface, and utilize a Web Application Firewall to drop requests containing suspicious or malformed input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical research write-up by Jiaqian Peng.

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat to organizational data integrity and availability. Administrators must prioritize the application of vendor-supplied firmware updates immediately to remediate the buffer overflow. If immediate patching is not feasible, restrict access to the device management interface to trusted internal segments only to reduce the attack surface.