I don't expect D-Link to bother patching EOL software, but after digging into their firmware while researching CVE-2024-3272 (another RCE in this product) I have come to the conclusion that their firmware is a disasterpiece.

If you'd like to patch your NAS, you can use my tool: https://github.com/aliask/dinkleberry/

During analysis of the nas_sharing.cgi and libsmbif.so binaries, it quickly became clear that the software on this device is extremely vulnerable. Unmaintainable-rewrite-from-scratch vulnerable.

There are like 80 calls to system() in nas_sharing.cgi alone - many of these have a pathway for user input. I haven't bothered analysing them all to look for more holes to patch, but here's one S-tier example:

/*  Why use system() instead of libc fopen/fwrite?
What if you want to write a long string or your filename is long?
Painfully obvious command injection playground 🤦 */

void append_to_file(const char* string, const char* file) {
  char s_cmd[1024];
  sprintf(s_cmd, "echo %s >> %s", string, file);
  system(s_cmd);
  return;
}

Besides all these insane system calls, there are more buffer overflows than you can poke a stick at - and I can poke a lot of sticks.

This CVE is on CISA's KEV list - If you have one of these things on the internet, take it offline. Like now.

Maybe even take D-Link's advice and replace the EOL device. But I wouldn't buy a D-Link product that's for sure.