CVE-2024-3272criticalunder attackCWE-798

CVE-2024-3272: critical vulnerability in D-Link DNS-320L

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

Published · Updated

Follow this CVE+ Monitor DNS-340L+ Monitor DNS-325

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weaponsame day
Published on NVDApr 4
1st PoCMar 26
CISA KEV+7d
Action required by CISAfederal deadline: 2024-05-02

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

In short

D-Link NAS devices contain hard-coded credentials in a web interface file that can be accessed remotely without authentication. An attacker can use these fixed credentials to gain unauthorized access to the device.

Technical detail

The /cgi-bin/nas_sharing.cgi HTTP GET request handler accepts a 'user' parameter that, when set to 'messagebus', exposes hard-coded credentials allowing remote authentication bypass. This affects DNS-320L, DNS-325, DNS-327L, and DNS-340L devices up to firmware version 20240403. No user interaction is required; the attack is network-accessible and exploits insufficient credential management.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
D-Link · DNS-320LD-Link · DNS-325D-Link · DNS-327LD-Link · DNS-340L
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — D-Link DNS-320L

In the same product, most dangerous first.

CVE-2024-3273HIGHD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injectionEPSS 100.0%KEVCVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.5%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-3274MEDIUMD-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosureEPSS 33.5%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%CVE-2024-8132MEDIUMD-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injectionEPSS 24.4%