A critical stack-based buffer overflow in various D-Link NAS devices allows remote authenticated attackers to compromise system integrity or cause a denial of service.

The vulnerability exists in the cgi_adduser_to_session function within the account_mgr.cgi binary, which fails to perform boundary checks on the read_list, write_list, and decline_list parameters. An authenticated attacker can trigger a stack-based buffer overflow by sending a specially crafted HTTP POST request, potentially resulting in remote code execution.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected NAS hardware with elevated privileges. This poses a severe risk of data exfiltration, unauthorized access to stored files, or total system compromise. Given the high CVSS score of 8.8, this vulnerability represents a significant threat to operational continuity and data confidentiality.

Immediate Action: There is currently no official patch available from the vendor. Users should restrict administrative access to these devices to trusted internal networks only and disable remote management interfaces if they are exposed to the public internet.

Proactive Monitoring: Monitor network traffic and web server access logs for anomalous HTTP POST requests directed at /cgi-bin/account_mgr.cgi, particularly those containing abnormally long strings in the specified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules designed to detect and block oversized input strings directed at the vulnerable account_mgr.cgi endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's technical write-up on GitHub.

The severity of this vulnerability necessitates immediate attention, even in the absence of a vendor-supplied patch. Administrators must prioritize isolating these devices from external networks to prevent remote exploitation. Once D-Link releases a firmware update, it should be tested and deployed across all affected units as a matter of urgency to mitigate the risk of arbitrary code execution.