---
id: "CVE-2024-3273"
kind: "vulnerability"
aliases: ["CVE-2024-3273"]
title: "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "D-Link Multiple NAS Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-320l firmware", "fixed": [], "affected": "= 1.01.0702.2013", "ecosystem": "vendor"}, {"name": "dlink dns-320l firmware", "fixed": [], "affected": "= 1.03.0904.2013", "ecosystem": "vendor"}, {"name": "dlink dns-320l firmware", "fixed": [], "affected": "= 1.11", "ecosystem": "vendor"}, {"name": "dlink dns-120 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dnr-202l firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-315l firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-320 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-320lw firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-321 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dnr-322l firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-323 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-325 firmware", "fixed": [], "affected": "= 1.01", "ecosystem": "vendor"}, {"name": "dlink dns-326 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-327l firmware", "fixed": [], "affected": "= 1.00.0409.2013", "ecosystem": "vendor"}, {"name": "dlink dns-327l firmware", "fixed": [], "affected": "= 1.09", "ecosystem": "vendor"}, {"name": "dlink dnr-326 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-340l firmware", "fixed": [], "affected": "= 1.08", "ecosystem": "vendor"}, {"name": "dlink dns-343 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-345 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-726-4 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-1100-4 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-1200-05 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dlink dns-1550-04 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["d-link", "exploited", "infrastructure", "nas", "self-hosted"]
not_affected_if: ["no-dns-320l-dns-325-dns-327l-dns-340l", "replaced-hardware"]
published_at: "2024-04-04T01:15:50+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3273", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3273", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L,…

D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices have a command injection flaw that, combined with CVE-2024-3272, allows remote unauthenticated code execution. An attacker gets a shell on the device and can read or change files stored on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:D-Link Multiple NAS Devices affected ? fixed ?
- vendor:dlink dns-320l firmware affected = 1.01.0702.2013 fixed ?
- vendor:dlink dns-320l firmware affected = 1.03.0904.2013 fixed ?
- vendor:dlink dns-320l firmware affected = 1.11 fixed ?
- vendor:dlink dns-120 firmware affected ? fixed ?
- vendor:dlink dnr-202l firmware affected ? fixed ?
- vendor:dlink dns-315l firmware affected ? fixed ?
- vendor:dlink dns-320 firmware affected ? fixed ?
- vendor:dlink dns-320lw firmware affected ? fixed ?
- vendor:dlink dns-321 firmware affected ? fixed ?
- vendor:dlink dnr-322l firmware affected ? fixed ?
- vendor:dlink dns-323 firmware affected ? fixed ?
- vendor:dlink dns-325 firmware affected = 1.01 fixed ?
- vendor:dlink dns-326 firmware affected ? fixed ?
- vendor:dlink dns-327l firmware affected = 1.00.0409.2013 fixed ?
- vendor:dlink dns-327l firmware affected = 1.09 fixed ?
- vendor:dlink dnr-326 firmware affected ? fixed ?
- vendor:dlink dns-340l firmware affected = 1.08 fixed ?
- vendor:dlink dns-343 firmware affected ? fixed ?
- vendor:dlink dns-345 firmware affected ? fixed ?
- vendor:dlink dns-726-4 firmware affected ? fixed ?
- vendor:dlink dns-1100-4 firmware affected ? fixed ?
- vendor:dlink dns-1200-05 firmware affected ? fixed ?
- vendor:dlink dns-1550-04 firmware affected ? fixed ?

## How to check

Identify whether any D-Link DNS-320L, DNS-325, DNS-327L or DNS-340L NAS is on the network, for example by checking device labels or the admin inventory.

## Fix

Retire and replace the affected end-of-life D-Link NAS devices per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3273
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-3273

## From the sources

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_