NetSight
IP …
critical9.8Known exploited

CVE-2024-3272

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-04-11. Federal due date: 2024-05-02.

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

Impact

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Affected products

VendorProductAffected versions
DlinkDns-320l Firmware
Versions 1.01.0702.2013, 1.03.0904.2013, 1.11
DlinkDns-120 Firmware
All versions
DlinkDnr-202l Firmware
All versions
DlinkDns-315l Firmware
All versions
DlinkDns-320 Firmware
All versions
DlinkDns-320lw Firmware
All versions
DlinkDns-321 Firmware
All versions
DlinkDnr-322l Firmware
All versions
DlinkDns-323 Firmware
All versions
DlinkDns-325 Firmware
Version 1.01
DlinkDns-326 Firmware
All versions
DlinkDns-327l Firmware
Versions 1.00.0409.2013, 1.09

Weakness classification

CWE-798

References