CVEvulnerability

CVE-2024-3273

9.8 CRITICAL Known exploited Published 2024-04-04 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

D-Link Multiple NAS Devices Command Injection Vulnerability — D-Link Multiple NAS Devices

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

Added to KEV: 2024-04-11
Remediation due: 2024-05-02
Ransomware use: Unknown
Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Notes: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273

Status: Analyzed
Published: 2024-04-04
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-77

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Affected configurations

• dlink dns-320l firmware 1.01.0702.2013 • dlink dns-320l firmware 1.03.0904.2013 • dlink dns-320l firmware 1.11 • dlink dns-120 firmware • dlink dnr-202l firmware • dlink dns-315l firmware • dlink dns-320 firmware • dlink dns-320lw firmware • dlink dns-321 firmware • dlink dnr-322l firmware • dlink dns-323 firmware • dlink dns-325 firmware 1.01 • dlink dns-326 firmware • dlink dns-327l firmware 1.00.0409.2013 • dlink dns-327l firmware 1.09 • dlink dnr-326 firmware • dlink dns-340l firmware 1.08 • dlink dns-343 firmware • dlink dns-345 firmware • dlink dns-726-4 firmware • dlink dns-1100-4 firmware • dlink dns-1200-05 firmware • dlink dns-1550-04 firmware

Weakness · CWE (1)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References