An authenticated remote memory corruption vulnerability in the D-Link DSM-G600 firmware allows attackers to crash the management interface, resulting in a denial of service.

This vulnerability is an out-of-bounds write flaw occurring within the load_file.cgi component of the HTTP management daemon. An attacker with administrative credentials can trigger a segmentation fault by submitting an oversized multipart POST request, leading to a denial of service.

The successful exploitation of this vulnerability results in the disruption of the device management interface, which prevents administrators from reconfiguring or monitoring the affected hardware. While the CVSS score of 8.8 suggests high severity, the impact is primarily limited to a denial of service condition for the administrative interface rather than unauthorized data access. Nevertheless, the instability of critical network infrastructure components presents a significant operational risk.

Immediate Action: Since no official patch is currently available, restrict access to the device web management interface to trusted management networks only to prevent unauthorized authentication.

Proactive Monitoring: Monitor device logs for repeated authentication attempts followed by service crashes or unexpected reboots of the HTTP daemon.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level traffic filtering to inspect and block multipart POST requests to /load_file.cgi that exceed standard configuration file sizes.

Public Exploit Available: Yes, a proof-of-concept script exists as documented in the research write-up by the vulnerability reporter.

Given the availability of public proof-of-concept code and the critical nature of network storage devices, administrators must prioritize restricting access to the management console immediately. While the vendor is expected to release a fix, organizations should treat this device as high-risk and ensure it is not exposed to the public internet until a firmware update is applied.