An authenticated remote code execution vulnerability in D-Link ShareCenter NAS devices poses a critical risk to data integrity and network security.

The vulnerability is an OS command injection flaw located in the /cgi-bin/isomount_mgr.cgi script. An attacker with authenticated administrative access to the web interface can manipulate the upIsoRootPath parameter to inject and execute arbitrary shell commands with the privileges of the CGI process.

Successful exploitation allows an attacker to gain full control over the affected network-attached storage device. This can lead to unauthorized access to sensitive stored data, the modification of system configurations, disruption of services, or the use of the NAS as a pivot point to conduct further attacks within the internal network. The CVSS score of 9.9 reflects the severe impact on confidentiality, integrity, and availability.

Immediate Action: Update affected D-Link NAS devices to the latest available firmware provided by the vendor. If an update is not immediately available, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web access logs for unusual POST requests directed at /cgi-bin/isomount_mgr.cgi, particularly those containing shell metacharacters such as semicolons or pipe symbols in the upIsoRootPath parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious command injection patterns directed at the identified CGI endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

Given the critical CVSS severity and the presence of a public proof-of-concept, users must prioritize patching these devices immediately. Administrative interfaces for storage devices should never be exposed to the public internet, and internal access should be strictly governed by the principle of least privilege to mitigate the impact of compromised credentials.