Description

A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-31T11:16:40.177Z",
  "pubdate": "2026-08-31T11:16:40.177Z",
  "executiveSummary": "A critical remote vulnerability has been identified in the D-Link DSM-G600 wireless network storage device, specifically affecting version 1.01. The security flaw exists within the Multipart Handler component during the processing of HTTP requests directed at the /load_file.cgi endpoint.\nUnder specific conditions, improper validation of input boundaries allows a remote, unauthenticated attacker to execute a manipulation that triggers an out-of-bounds write condition. The risk implications of this vulnerability are severe, as successful exploitation can compromise the integrity and availability of the device's memory space, potentially leading to arbitrary code execution or system instability.\nBecause the exploit code has been made publicly available, the likelihood of opportunistic attacks against exposed legacy devices is significantly elevated. Organizations deploying these devices face a heightened risk of unauthorized access, device takeover, and potential lateral movement within the local network. Due to the remote nature of the attack vector and the lack of required authentication, immediate mitigation is necessary to protect vulnerable hardware endpoints from potential compromise.",
  "technicalDetails": "The vulnerability in the D-Link DSM-G600 version 1.01 resides within the firmware's web server component responsible for handling multipart/form-data HTTP POST requests. Specifically, the file /load_file.cgi utilizes a Multipart Handler component to parse incoming data streams. When a remote attacker transmits a specially crafted HTTP request to this endpoint, the Multipart Handler fails to properly validate the length of the boundary or the input data fields relative to the pre-allocated buffer size in memory.\nThis lack of bounds checking results in an out-of-bounds write vulnerability. During the parsing process, the application copies user-controlled data into a fixed-size buffer on the stack or heap without verifying that the input size is within safe limits. By manipulating the multipart headers or the content length of the payload, an attacker can overwrite adjacent memory locations beyond the intended buffer boundary. This memory corruption can overwrite critical control data, such as saved frame pointers or return addresses.\nThe typical attack flow proceeds as follows: First, the attacker identifies an active D-Link DSM-G600 device exposed to the network, specifically targeting the HTTP daemon. Second, the attacker constructs a malicious HTTP POST request directed at the /load_file.cgi endpoint, containing anomalous boundary parameters or excessively long data sequences within the multipart payload. Third, the web server receives the request and passes the payload to the Multipart Handler. Fourth, the handler processes the input without adequate bounds verification, causing the input data to spill over the allocated buffer limits. Fifth, the out-of-bounds write corrupts the device's memory, altering execution flow.\nIf the overwritten memory includes executable instructions or return pointers, the attacker may achieve remote code execution (RCE) with the privileges of the web server daemon, which often runs with administrative or root privileges on embedded devices of this generation. Alternatively, if code execution is not achieved, the corruption of vital memory structures will trigger a denial-of-service (DoS) state, causing the device to crash or reboot. Because the exploit is public, the complexity of launching this attack is low, requiring no authentication or local access.\nThis vulnerability is particularly critical due to the lack of modern exploit mitigations (such as Address Space Layout Randomization (ASLR) or stack canaries) in the legacy firmware of the D-Link DSM-G600. Consequently, exploitation attempts are highly reliable, and the public availability of functional exploit code lowers the barrier to entry for malicious actors seeking to compromise these end-of-life storage units."
}