CVE-2024-3273highunder attackCWE-77

CVE-2024-3273: high-severity vulnerability in D-Link DNS-320L

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

Published · Updated

Follow this CVE+ Monitor DNS-340L+ Monitor DNS-325

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.3epss 100%
from disclosure to weaponsame day
Published on NVDApr 4
1st PoCMar 26
CISA KEV+7d
Action required by CISAfederal deadline: 2024-05-02

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

In short

D-Link NAS devices contain a command injection vulnerability in their web interface that allows attackers to execute arbitrary commands remotely by sending specially crafted HTTP requests. This affects unsupported models and could give attackers complete control over the device.

Technical detail

A command injection vulnerability exists in the /cgi-bin/nas_sharing.cgi endpoint where the 'system' parameter in HTTP GET requests is not properly sanitized, allowing remote code execution without authentication. The vulnerability affects D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L models up to firmware version 20240403; exploitation requires network access to the device's web interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
D-Link · DNS-320LD-Link · DNS-325D-Link · DNS-327LD-Link · DNS-340L
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — D-Link DNS-320L

In the same product, most dangerous first.

CVE-2024-3272CRITICALD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsEPSS 98.1%KEVCVE-2024-10914CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 97.5%CVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-3274MEDIUMD-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosureEPSS 33.5%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%CVE-2024-8132MEDIUMD-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injectionEPSS 24.4%