Remote Out-of-Bounds Write Vulnerability in D-Link DSM-G600

D-Link DSM-G600 version 1.01 contains a critical vulnerability within the multipart handler component, specifically located in the /load_file.cgi script. This flaw allows a remote, unauthenticated attacker to trigger an out-of-bounds write condition. Because the device handles multipart requests, improper bounds checking during the processing of these requests enables the corruption of memory, which can lead to arbitrary code execution or permanent system instability. Public exploit code for this vulnerability is currently available, significantly lowering the barrier for exploitation by malicious actors. Given the nature of the device as a storage/network component, successful exploitation could provide an attacker with a foothold for lateral movement within the internal network or the exfiltration of stored data.

Impact

Successful exploitation of CVE-2026-82680 allows for remote code execution on the affected D-Link DSM-G600 devices. This impact represents a high risk to organizational security, as compromised network storage devices can be leveraged for persistence, internal reconnaissance, or as a pivot point for further network attacks.

Recommendation

Prioritize the decommissioning or isolation of legacy D-Link DSM-G600 devices, as version 1.01 is significantly outdated and lacks modern security hardening. For environments where the device cannot be decommissioned, ensure that the /load_file.cgi endpoint is not accessible from untrusted or public-facing network segments. Implement network-level access control lists (ACLs) to restrict traffic to the management interface of the device to known, authorized administrative IP addresses.