CVE-2024-3273

{"id": "CVE-2024-3273", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "[email protected]"}], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-04-04T01:15:50.387", "references": [{"url": "https://github.com/netsecfish/dlink", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.259284", "tags": ["Permissions Required", "VDB Entry"], "source": "[email protected]"}, {"url": "https://vuldb.com/?id.259284", "tags": ["Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.304661", "tags": ["Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://github.com/netsecfish/dlink", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.259284", "tags": ["Permissions Required", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.259284", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?submit.304661", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced."}, {"lang": "es", "value": "** NO SOPORTADO CUANDO SE ASIGN\u00d3 ** Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en D-Link DNS-320L, DNS-325, DNS-327L y DNS-340L hasta 20240403. Una funci\u00f3n desconocida del archivo / cgi-bin/nas_sharing.cgi del componente HTTP GET Request Handler. La manipulaci\u00f3n del SYSTEM de argumentos conduce a la inyecci\u00f3n de comandos. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-259284. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. NOTA: Se contact\u00f3 primeramente con el proveedor y se confirm\u00f3 de inmediato que el producto ha llegado al final de su vida \u00fatil. Deber\u00eda retirarse y reemplazarse."}], "lastModified": "2025-10-30T19:53:04.050", "cisaActionDue": "2024-05-02", "cisaExploitAdd": "2024-04-11", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F733CFC-CB96-46B0-AE7E-21822560C774"}, {"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93290C71-4CDF-4645-AB29-49E832AE6BF4"}, {"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91A5ABBE-0AC8-47CB-B420-3C68020B9132"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6C677E53-6885-4EC4-A7CC-E24E8F445F59"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C44BE2C6-BF3E-43C3-B32F-2DCE756F94BC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6E161E54-2FE9-4359-9B2D-8700D00DE8E7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96195649-172A-4C21-AA15-7B05F86C5CEC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "07A92F2C-16FD-4A53-8066-83FEC2818DF5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8CFCD7B-EFFB-4FAB-9537-46AC7B567126"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03C5CED7-55A7-4026-95CD-A2ADB5853823"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4452F9A4-3A0A-4773-9818-04C94CF9F8E7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A0F5355E-F68D-49FE-9793-1FD9BD9AF3E1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FE78C5B-2A98-47EE-BF67-CF58AFE50A37"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "45467ABC-BAA9-4EB0-9F97-92E31854CA8B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC28053F-88A9-4CA1-A2A2-CC90FEEA68FC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2A278BC9-6197-43D9-93C2-3DF760856FB7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD3AD5EE-8E1E-4336-A1AB-AB028CC71286"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5DAF62A4-2429-4B89-8FAD-8B23EF15E050"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "641CB5F1-3DE0-480B-95A4-FC42A8FF3C97"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "94ED678A-AB4C-4637-B0D8-C232A0BB5D5F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F42F8AA8-30F9-46D9-92D9-CF8876E04FFA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8042169D-D9FA-4BD6-90D1-E0DE269E42B9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5E6F048-D865-4378-87C7-B0E528134276"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D26F4F77-A6E3-4D7D-A781-BEB5FF7BC44F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "288DA5DF-BC45-4B81-82C6-9E78417F415B"}, {"criteria": "cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45D36608-4CCB-4B4F-AC7C-AB925817FF83"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DB305B29-7F89-4A52-9ECF-3DB0BDD2350D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "816E5F34-CE76-49E5-91F3-8CC84C561558"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33CB308B-CF82-4E40-B2DC-23EBD48CD130"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A2A09C0-1495-4999-A2B2-CE3474A02CC8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0646B20C-5642-4CEA-A96C-7E82AD94A281"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD656642-EDD4-4EB2-81AB-04207BC14196"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F968791D-D3BD-442C-818E-4E878B12776D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12C5E2D7-018E-4ED1-92C7-B5B1D8CC6990"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C7E56821-7EA0-4CA1-BA17-7FD4ED9F794C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A74D270-9076-474D-A06F-C915FCEA2164"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "75E5010F-21BA-4B6B-B00C-2688268FD67B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CAFE1E3-B705-4CF1-AEB9-A474432B6D34"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D5D08ED7-3E7F-4D30-890E-6535F6C34682"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42DA6DEB-3578-44A5-916F-1628141F0DDE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D042C75D-6731-46B2-B11E-A009B9029B3F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2C1EF70-AD9B-48D7-8DF6-A6416C517F12"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E691E775-382C-4BA9-AA44-FBC3148D3E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]", "cisaRequiredAction": "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "cisaVulnerabilityName": "D-Link Multiple NAS Devices Command Injection Vulnerability"}