{"id":"CVE-2024-3273","kind":"vulnerability","aliases":["CVE-2024-3273"],"related":[],"title":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L,…","description":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.","summary":"D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices have a command injection flaw that, combined with CVE-2024-3272, allows remote unauthenticated code execution. An attacker gets a shell on the device and can read or change files stored on it.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-04-11T00:00:00+00:00","products":[{"name":"D-Link Multiple NAS Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.01.0702.2013","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.03.0904.2013","ecosystem":"vendor"},{"name":"dlink dns-320l firmware","fixed":[],"affected":"= 1.11","ecosystem":"vendor"},{"name":"dlink dns-120 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dnr-202l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-315l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-320lw firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-321 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dnr-322l firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-323 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-325 firmware","fixed":[],"affected":"= 1.01","ecosystem":"vendor"},{"name":"dlink dns-326 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-327l firmware","fixed":[],"affected":"= 1.00.0409.2013","ecosystem":"vendor"},{"name":"dlink dns-327l firmware","fixed":[],"affected":"= 1.09","ecosystem":"vendor"},{"name":"dlink dnr-326 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-340l firmware","fixed":[],"affected":"= 1.08","ecosystem":"vendor"},{"name":"dlink dns-343 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-345 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-726-4 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1100-4 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1200-05 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dns-1550-04 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","exploited","infrastructure","nas","self-hosted"],"not_affected_if":["no-dns-320l-dns-325-dns-327l-dns-340l","replaced-hardware"],"how_to_check":"Identify whether any D-Link DNS-320L, DNS-325, DNS-327L or DNS-340L NAS is on the network, for example by checking device labels or the admin inventory.","fix":"Retire and replace the affected end-of-life D-Link NAS devices per vendor instructions, as CISA requires.","status":"open","published_at":"2024-04-04T01:15:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:51+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:00:51Z","model":"claude-haiku-5-5","output":{"fix":"Retire and replace the affected end-of-life D-Link NAS devices per vendor instructions, as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices have a command injection flaw that, combined with CVE-2024-3272, allows remote unauthenticated code execution. An attacker gets a shell on the device and can read or change files stored on it.","category":"infrastructure","who_cares":["d-link","nas","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands on the NAS device","analyst_note":"Confirm the how-to-check and mitigation steps for devices that cannot be replaced; check the CISA KEV entry and D-Link advisories for any firmware fix.","how_to_check":"Identify whether any D-Link DNS-320L, DNS-325, DNS-327L or DNS-340L NAS is on the network, for example by checking device labels or the admin inventory.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-dns-320l-dns-325-dns-327l-dns-340l","replaced-hardware"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000524,"input_tokens":2886,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':136A '-05':131A '-1100':125A '-120':49A '-1200':130A '-1550':135A '-2024':21A,24A,173B '-259284':279C '-320':63A '-321':72A '-323':81A '-325':85A,154B,215C '-326':89A,103A '-3272':174B '-3273':22A,25A '-343':112A '-345':116A '-4':121A,126A '-726':120A '/cgi-bin/nas_sharing.cgi':234C '20240403':225C '202l':54A '315l':59A '320l':19A,35A,40A,45A,152B,213C '320lw':68A '322l':77A '327l':94A,99A,157B,218C '340l':108A,161B,222C 'affect':226C,284C 'allow':175B 'argument':246C 'assign':3A,197C 'attack':181B,258C 'chang':192B 'classifi':8A,202C 'code':178B 'combin':170B 'command':166B,250C 'compon':237C 'confirm':300C 'contact':297C 'critic':10A,204C 'cve':20A,23A,172B 'd':15A,27A,139B,148B,209C 'd-link':14A,26A,138B,147B,208C 'devic':163B,187B 'devices':31A 'disclos':264C 'dlink':32A,37A,42A,47A,51A,56A,61A,65A,70A,74A,79A,83A,87A,91A,96A,101A,105A,110A,114A,118A,123A,128A,133A 'dnr':53A,76A,102A 'dnr-202l':52A 'dnr-322l':75A 'dns':18A,34A,39A,44A,48A,58A,62A,67A,71A,80A,84A,88A,93A,98A,107A,111A,115A,119A,124A,129A,134A,151B,153B,156B,160B,212C,214C,217C,221C 'dns-315l':57A 'dns-320l':17A,33A,38A,43A,150B,211C 'dns-320lw':66A 'dns-327l':92A,97A,155B,216C 'dns-340l':106A,159B,220C 'earli':298C 'end':307C 'end-of-lif':306C 'execut':179B 'exploit':141B,261C 'file':193B,233C 'firmware':36A,41A,46A,50A,55A,60A,64A,69A,73A,78A,82A,86A,90A,95A,100A,104A,109A,113A,117A,122A,127A,132A,137A 'flaw':168B 'found':12A,206C 'function':230C 'get':182B,239C 'handler':241C 'host':146B 'http':238C 'identifi':273C 'immedi':301C 'infrastructur':142B 'inject':167B,251C 'launch':256C 'lead':248C 'life':309C 'link':16A,28A,140B,149B,210C 'longer':289C 'maintain':293C 'manipul':243C 'may':269C 'multiple':29A 'nas':30A,143B,162B 'note':280C,294C 'possibl':254C 'product':285C,304C 'public':267C 'read':190B 'remot':176B,259C 'replac':315C 'request':240C 'retir':313C 'self':145B 'self-host':144B 'shell':184B 'store':194B 'support':290C 'system':247C 'unauthent':177B 'unknown':229C 'unsupport':1A,195C 'use':271C 'vdb':278C 'vendor':295C 'vulner':5A,199C,276C,282C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-04T01:15:50+00:00","kev":{"dateAdded":"2024-04-11","dueDate":"2024-05-02","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-3273","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3273","severity":null,"published_at":"2024-04-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-3273","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3273","severity":null,"published_at":"2024-04-04T01:15:50+00:00","modified_at":"2026-06-17T07:43:41+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}