CVE-2024-3273

KEVD-Link Multiple NAS Devices Command Injection Vulnerability

Description

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

PublishedApr 4, 2024

Last modifiedJun 17, 2026

Added to KEVApr 11, 2024

Remediation dueMay 2, 2024

References

github.com/netsecfish/dlinkExploitThird Party Advisory
supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383Vendor Advisory
vuldb.com/?ctiid.259284Permissions RequiredVDB Entry
vuldb.com/?id.259284Third Party AdvisoryVDB Entry
vuldb.com/?submit.304661Third Party AdvisoryVDB Entry
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273US Government Resource
greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wildThird Party Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 909 days
CVSS: 7.3 HIGH
EPSS (30-day exploit probability): 100.0% · top 1% of all CVEs
Weakness: CWE-77
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.