CVE-2018-25120

The web script handling the '/goform/Mail_Test' endpoint passes form parameters directly to a system call for the email tool without proper input validation. An attacker can provide crafted form data containing additional shell commands that will be executed by the device's operating system. The vulnerability is available without authentication, meaning any network user with access to the web interface can exploit it.

The attacker gains remote code execution (RCE) with root privileges on the vulnerable device, giving them full control over the device and stored data.

D-Link manufacturer has announced end-of-life for the DNS-343 product line — no security patches will be released. It is recommended to immediately remove devices from operation or at least isolate them from public networks and untrusted network segments (e.g., restrict access to the web interface only from trusted IP addresses using a firewall). Ultimately, devices should be replaced with supported hardware from another manufacturer or a newer D-Link product line.

D-Link DNS-343 ShareCenter with firmware versions up to and including 1.05.