“The request includes parameters for a username (user=messagebus) and an empty password field (passwd=).”
D-Link shipped NAS boxes with a hardcoded account named messagebus and no password. The same CGI script then runs whatever base64 command an attacker puts in the system parameter. That covers the DNS-320L, DNS-325, DNS-327L and DNS-340L, with over 92,000 of them reachable from the Internet. The entire fix section is one line telling owners to apply the manufacturer’s patches. The manufacturer is the one who left the door open.