This is a technical writeup detailing two vulnerabilities in D-Link DNS-323 firmware 1.09: arbitrary file upload via directory traversal and OS command execution through parameter injection in the 'SCHEDULE DOWNLOAD' feature. Both require authentication but can be exploited as root.
Classification
Writeup 90%
Attack Type
Rce | Info Leak
Complexity
Moderate
Reliability
Reliable
Target:D-Link DNS-323 firmware 1.09
Auth required
Prerequisites:authenticated user access · network access to the NAS web interface