| Titel | D-Link D-Link DNS-320 ShareCenter NAS DNS-320 REVA Firmware 2.06B01 HOTFIX OS Command Injection |
|---|
| Beschreibung | ## Basic Information
| Field | Value |
| ------------------ | ------------------------------------------------------------ |
| Internal ID | DLINK-CMD-009 |
| Vendor | D-Link |
| Product | D-Link DNS-320 ShareCenter NAS |
| Firmware Version | DNS-320 REVA Firmware 2.06B01 HOTFIX |
| Component | `/cgi/backup_mgr/remote_backup.cgi cgi_check_rsync_rw` |
| Vulnerability Type | OS Command Injection |
| CWE | CWE-78 |
| CVSS v3.1 | 8.8 (High) |
| CVSS Vector | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Authentication | Authenticated / administrative web session or equivalent CGI access |
| Status | Confirmed with dynamic PoC evidence |
## Summary
The remote backup CGI builds an rsync shell command from CGI parameters including ip and rsync_user. Dynamic QEMU execution of the original CGI reached /bin/sh -c with attacker-controlled shell metacharacters embedded in the rsync command line.
## Proof of Concept
```text
cmd=cgi_check_rsync_rw with ip or rsync_user containing `X;echo <MARKER> >/tmp/<sentinel>;#` while the local path points to an existing share directory.
```
## Dynamic Verification Evidence
`execve("/bin/sh", {"sh", "-c", "/usr/sbin/rsync ... u@X;echo IP_CONFIRMED>/tmp/firmrec_dlink_ip_pwn;#::module ..."})` and the analogous `rsync_user` command line were recorded in strace.
Evidence package included in this final bundle:
```text
VULNDB_FINAL_SUBMIT_READY_20260707/evidence_packages/DLINK_CMD_009_REMOTE_BACKUP_EVIDENCE_20260708/
```
Key artifacts:
- `chroot_param_matrix/summary.txt`
- `hostfs_param_matrix2/summary.txt`
- `ROUND9B_DLINK_REMOTE_BACKUP_DYNAMIC_CONFIRMED.md`
## Impact
Successful exploitation allows an authenticated attacker to execute arbitrary shell commands with the privileges of the NAS web/CGI runtime, which is sufficient for device compromise, persistence, data access, and lateral movement from the NAS environment.
|
|---|
| Quelle | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-009-vulndb.md |
|---|
| Benutzer | ST4R0001 (UID 99565) |
|---|
| Einreichung | 17.07.2026 18:37 (vor 2 Monaten) |
|---|
| Moderieren | 03.09.2026 16:27 (2 months later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 380827 [D-Link DNS-1550-04 bis 20260205 remote_backup.cgi cgi_check_rsync_rw ip erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|