Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-3272

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

Affects D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices that have reached end-of-life, which no longer receive firmware updates. No fix is available for these models.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
None on Exploit-DB, Metasploit or GitHub

Summary

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L network-attached storage devices are affected, specifically through their web interface's sharing configuration handler. An attacker could remotely log in using hard-coded built-in credentials, potentially gaining unauthorized control over the device and its stored data; these products are end-of-life and no longer receive vendor support.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • D-Link DNS-320L

    20240403

  • D-Link DNS-325

    20240403

  • D-Link DNS-327L

    20240403

  • D-Link DNS-340L

    20240403

References 4

vuldb.com

GitHub · netsecfish/dlink

supportannouncement.us.dlink.com

FAQ

Questions about CVE-2024-3272

What does this mean?

The nas_sharing.cgi web interface contains hard-coded credentials, so a remote party who knows them can send a crafted HTTP GET request and run arbitrary commands on the device. The impact could include access to sensitive information, changed system settings, or a denial of service.Source: supportannouncement.us.dlink.com, github.com

Am I affected, and how do I check?

The listed models are DNS-320L, DNS-325, DNS-327L and DNS-340L, and the advisory limits the issue to devices that have reached end-of-life or end-of-service. To check a device, look up its model on D-Link's product lifecycle information and confirm whether it is past EOL/EOS; the facts do not list specific firmware versions.Source: supportannouncement.us.dlink.com, github.com

What should I do about it?

No fixed firmware is available for these end-of-life models, so no upgrade target can be named. Replacing the device with a currently supported D-Link product is the course the facts support.Source: supportannouncement.us.dlink.com, github.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-04-11, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

What if there's no patch?

No patch is available because these products no longer receive firmware updates or security patches. The facts do not describe a vendor workaround, so the only documented step is to limit exposure of the device, such as keeping it off untrusted networks and the internet.Source: supportannouncement.us.dlink.com, github.com