{"id":"CVE-2024-3272","kind":"vulnerability","aliases":["CVE-2024-3272"],"related":[],"title":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link…","description":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.","summary":"D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices ship with a hard-coded credential. An attacker who uses it can run arbitrary commands on the device.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-04-11T00:00:00+00:00","products":[{"name":"D-Link Multiple NAS Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.01.0702.2013","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.03.0904.2013","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.11","ecosystem":"vendor"},{"name":"dlink dns-120 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dnr-202l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-315l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320lw firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-321 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dnr-322l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-323 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-325 firmware","fixed":[],"affected":"= 1.01","ecosystem":"vendor"},{"name":"dlink dns-326 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-327l firmware","fixed":[],"affected":"= 1.00.0409.2013","ecosystem":"vendor"},{"name":"dlink dns-327l firmware","fixed":[],"affected":"= 1.09","ecosystem":"vendor"},{"name":"dlink dnr-326 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-340l firmware","fixed":[],"affected":"= 1.08","ecosystem":"vendor"},{"name":"dlink dns-343 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-345 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-726-4 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1100-4 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1200-05 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1550-04 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","exploited","infrastructure","nas","self-hosted"],"not_affected_if":["no-affected-model"],"how_to_check":"Identify any D-Link DNS-320L, DNS-325, DNS-327L or DNS-340L on the network. unknown","fix":"Retire and replace the affected devices per vendor instructions, as all hardware revisions are end-of-life or end-of-service. unknown","status":"open","published_at":"2024-04-04T01:15:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:51+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:00:51Z","model":"claude-haiku-5-5","output":{"fix":"Retire and replace the affected devices per vendor instructions, as all hardware revisions are end-of-life or end-of-service. unknown","reach":"network","impact":"high","summary":"D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices ship with a hard-coded credential. An attacker who uses it can run arbitrary commands on the device.","category":"infrastructure","who_cares":["d-link","nas","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the NAS device.","analyst_note":"Confirm the vendor's replacement guidance and whether any firmware fix exists for these EOL models; the KEV entry gives no versions or detection steps.","how_to_check":"Identify any D-Link DNS-320L, DNS-325, DNS-327L or DNS-340L on the network. unknown","needs_analyst":true,"not_affected_if":["no-affected-model"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000481,"input_tokens":2896,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':135A '-05':130A '-1100':124A '-120':48A '-1200':129A '-1550':134A '-2024':20A,23A '-259283':274C '-320':62A '-321':71A '-323':80A '-325':84A,153B,204C '-326':88A,102A '-3272':21A,24A '-343':111A '-345':115A '-4':120A,125A '-726':119A '/cgi-bin/nas_sharing.cgi':224C '20240403':214C '202l':53A '315l':58A '320l':34A,39A,44A,151B,202C '320lw':67A '322l':76A '327l':93A,98A,156B,207C '340l':107A,160B,211C 'affect':217C,279C 'arbitrari':177B 'argument':236C 'assign':3A,184C 'associ':267C 'attack':171B,249C 'classifi':8A,189C 'code':168B,246C 'command':178B 'compon':227C 'confirm':295C 'contact':292C 'credenti':169B,247C 'critic':11A,192C 'cve':19A,22A 'd':17A,26A,138B,147B,198C 'd-link':16A,25A,137B,146B,197C 'devic':162B,181B 'devices':30A 'disclos':258C 'dlink':31A,36A,41A,46A,50A,55A,60A,64A,69A,73A,78A,82A,86A,90A,95A,100A,104A,109A,113A,117A,122A,127A,132A 'dnr':52A,75A,101A 'dnr-202l':51A 'dnr-322l':74A 'dns':33A,38A,43A,47A,57A,61A,66A,70A,79A,83A,87A,92A,97A,106A,110A,114A,118A,123A,128A,133A,150B,152B,155B,159B,201C,203C,206C,210C 'dns-315l':56A 'dns-320l':32A,37A,42A,149B,200C 'dns-320lw':65A 'dns-327l':91A,96A,154B,205C 'dns-340l':105A,158B,209C 'earli':293C 'end':302C 'end-of-lif':301C 'exploit':140B,255C 'file':223C 'firmware':35A,40A,45A,49A,54A,59A,63A,68A,72A,77A,81A,85A,89A,94A,99A,103A,108A,112A,116A,121A,126A,131A,136A 'found':14A,195C 'get':229C 'handler':231C 'hard':167B,245C 'hard-cod':166B,244C 'host':145B 'http':228C 'identifi':268C 'immedi':296C 'infrastructur':141B 'initi':252C 'input':240C 'issu':216C 'lead':242C 'life':304C 'link':18A,27A,139B,148B,199C 'longer':284C 'maintain':288C 'manipul':233C 'may':250C,263C 'messagebus':241C 'multiple':28A 'nas':29A,142B,161B 'note':275C,289C 'process':220C 'product':280C,299C 'public':261C 'remot':253C 'replac':310C 'request':230C 'retir':308C 'run':176B 'self':144B 'self-host':143B 'ship':163B 'support':285C 'unknown':219C 'unsupport':1A,182C 'use':173B,265C 'user':237C 'vdb':273C 'vendor':290C 'vulner':5A,186C,271C,277C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-04T01:15:50+00:00","kev":{"dateAdded":"2024-04-11","dueDate":"2024-05-02","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-3272","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3272","severity":null,"published_at":"2024-04-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-3272","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3272","severity":null,"published_at":"2024-04-04T01:15:50+00:00","modified_at":"2026-06-17T07:43:41+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}