Critical Command Injection (CVE‑2020‑25506) in D‑Link DNS‑320 NAS Devices Allows Remote Code Execution
What It Is — The D‑Link DNS‑320 network‑attached storage (NAS) appliance contains a command‑injection flaw in the system_mgr.cgi component. An unauthenticated attacker can inject OS commands via crafted HTTP requests, leading to remote code execution.
Exploitability — Publicly disclosed; proof‑of‑concept scripts are available. CVSS v3.1 base score 9.8 (Critical). No patch existed at initial disclosure; D‑Link later released a firmware update.
Affected Products — D‑Link DNS‑320 series (all firmware versions prior to the security update).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous vulnerability scanning and timely patching as a core Vulnerability Management control.
- Absence of documented remediation evidence can break audit trails required by multiple frameworks that map to the VCF control “Maintain a documented process for identifying, assessing, and remediating vulnerabilities.”
- Automated evidence collection (scan results, patch logs) provides defensible proof to regulators and enterprise buyers that the organization maintains a trusted security posture.
Recommended Actions
- Inventory all D‑Link DNS‑320 devices and verify current firmware versions.
- Apply the vendor‑provided security patch or upgrade to a supported model.
- Integrate the devices into your automated vulnerability‑management pipeline and capture remediation evidence for audit readiness.
- Review network segmentation to limit external access to NAS management interfaces.
Source: CISA Known Exploited Vulnerabilities (KEV) – CVE‑2020‑25506