CVE-2024-3272
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
Description
CVE-2024-3272 is a critical hard-coded credentials vulnerability in multiple D-Link NAS devices including the DNS-320L, DNS-325, DNS-327L, and DNS-340L. With a CVSS v3.1 base score of 9.8, this flaw exists in the /cgi-bin/nas_sharing.cgi HTTP GET Request Handler, where the user parameter accepts the hard-coded credential value messagebus that provides unauthorized access to NAS functionality. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 2, 2024, and the ransomware association is classified as unknown. The EPSS score of 94.17% at the 99.9th percentile confirms near-universal exploitation of exposed devices. All affected devices were end-of-life when the vulnerability was disclosed, meaning D-Link will not release patches.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dns-320l firmware | 1.01.0702.2013; 1.03.0904.2013; 1.11 |
| dlink | dns-120 firmware | - |
| dlink | dnr-202l firmware | - |
| dlink | dns-315l firmware | - |
| dlink | dns-320 firmware | - |
| dlink | dns-320lw firmware | - |
| dlink | dns-321 firmware | - |
| dlink | dnr-322l firmware | - |
| dlink | dns-323 firmware | - |
| dlink | dns-325 firmware | 1.01 |
| dlink | dns-326 firmware | - |
| dlink | dns-327l firmware | 1.00.0409.2013; 1.09 |
| dlink | dnr-326 firmware | - |
| dlink | dns-340l firmware | 1.08 |
| dlink | dns-343 firmware | - |
| dlink | dns-345 firmware | - |
| dlink | dns-726-4 firmware | - |
| dlink | dns-1100-4 firmware | - |
| dlink | dns-1200-05 firmware | - |
| dlink | dns-1550-04 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/netsecfish/dlink(Exploit, Third Party Advisory)
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383(Vendor Advisory)
- https://vuldb.com/?ctiid.259283(Permissions Required)
- https://vuldb.com/?id.259283(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-3272 by NVD. Based on the vulnerability characteristics, this is a hard-coded credentials vulnerability (typically classified as CWE-798: Use of Hard-coded Credentials). The /cgi-bin/nas_sharing.cgi script contains a built-in credential check that accepts the username messagebus as a valid authentication token. This hard-coded credential was likely intended for inter-process communication during development or for internal service-to-service authentication, but it is accessible through the external HTTP interface. Any attacker who knows this credential value can bypass the authentication mechanism entirely, gaining access to NAS management functions that should require legitimate user credentials.
Impact Analysis
The impact of CVE-2024-3272 is severe across all dimensions of the CIA triad, reflecting the complete authentication bypass achieved through the hard-coded credential. Confidentiality is fully compromised because the hard-coded messagebus credential grants access to NAS management functions that expose stored data including personal files, documents, photos, videos, and backup archives. NAS devices commonly serve as centralized storage for home and small business users, often containing years of accumulated sensitive data. The attacker can exfiltrate all accessible files without triggering authentication failures or lockout mechanisms.
Integrity faces maximum impact as authenticated access to the NAS management interface allows the attacker to modify, delete, or encrypt stored files, create new user accounts for persistent access, change system configurations, and upload malicious files to shared directories. When combined with the companion vulnerability CVE-2024-3273 (command injection), the hard-coded credential provides a clean authentication bypass that enables arbitrary code execution.
Availability is critically impacted because the attacker can disrupt NAS services, format storage volumes, encrypt files for ransom, or render the device inoperable. The EPSS score of 94.17% at the 99.9th percentile confirms that virtually every exposed device faces exploitation attempts. The permanent nature of hard-coded credentials means the vulnerability cannot be mitigated through password changes or account management, and the end-of-life status of all affected devices eliminates any possibility of a vendor fix.
Exploit Maturity
CVE-2024-3272 has reached maximum exploit maturity with public exploit code, known hard-coded credential values, and mass exploitation campaigns. The EPSS score of 94.17% at the 99.9th percentile places this among the most heavily exploited vulnerabilities tracked. CISA's KEV listing with a May 2, 2024 deadline confirms active real-world exploitation at scale.
Public exploit code is available on GitHub at netsecfish/dlink, which documents the hard-coded messagebus credential and provides exploitation tools. The D-Link support announcement at D-Link SAP10383 confirms that all affected models are end-of-life with no patches planned. Exploitation is trivially simple, requiring only an HTTP GET request with the known credential value. The hard-coded nature of the credential means it cannot be changed, rotated, or disabled through normal device management. This vulnerability is commonly exploited in combination with CVE-2024-3273 (command injection), where the hard-coded credential provides the initial authentication bypass and the command injection enables arbitrary code execution on the device.
Remediation
-
Retire and replace all affected D-Link NAS devices immediately as the only effective remediation. Hard-coded credentials cannot be changed through configuration, and D-Link has confirmed at SAP10383 that no patches will be issued for these end-of-life products. Migrate all data to a currently supported NAS device from a vendor that provides active security maintenance.
-
Remove all internet exposure of affected NAS devices immediately as an emergency measure. Delete any port forwarding rules on your router that expose the NAS web interface (ports 80, 443, 8080) to the internet. The hard-coded credential is publicly known and exploitation is as simple as a single HTTP request, making internet-exposed devices essentially already compromised.
-
Isolate affected NAS devices on a dedicated network segment if they must remain operational during the transition period. Place the NAS on an isolated VLAN with strict firewall rules that only allow access from specific trusted hosts. Block all outbound internet access from the NAS to prevent data exfiltration and command-and-control communications.
-
Verify data integrity on affected devices before migrating to replacement hardware. Compare files against known-good backups, scan all data for malware, and check for unauthorized files placed on the device. Given the mass exploitation campaigns, any previously internet-exposed NAS should be treated as compromised.
-
Audit your network for all D-Link NAS models in the affected product range, which spans over 20 different models. Also ensure the companion vulnerability CVE-2024-3273 (command injection) is addressed on the same devices, as the two vulnerabilities are exploited together in active attack campaigns.
Technical Details
CVE-2024-3272 is a hard-coded credentials vulnerability in D-Link NAS devices, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability metric is at its most severe value. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means the exploit is trivially reliable since the credential is a fixed, known value. Privileges Required (PR:N) indicates no prior authentication is needed because the hard-coded credential itself serves as the bypass. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) remains unchanged within the NAS device context. All impact metrics are High, reflecting full compromise of the device.
The vulnerability exists in the /cgi-bin/nas_sharing.cgi script that handles HTTP GET requests on affected D-Link NAS devices. The script contains an authentication check that compares the user parameter against hard-coded values, including messagebus. When this value is provided, the script grants access to NAS management functions without requiring a valid password. The messagebus credential appears to be a service account intended for internal inter-process communication on the device's Linux-based operating system, but the CGI script's authentication logic inadvertently accepts it as a valid external user credential. The exploitation is a simple HTTP GET request: an attacker sends a request to /cgi-bin/nas_sharing.cgi with the user parameter set to messagebus, bypassing all authentication. This vulnerability affects firmware across over 20 D-Link NAS models from the DNS-120 through the DNS-1550-04 series, all of which have reached end-of-life status.
Frequently Asked Questions
What is CVE-2024-3272?
CVE-2024-3272 is a critical hard-coded credentials vulnerability in multiple D-Link NAS devices that allows unauthenticated remote attackers to bypass authentication using the built-in messagebus credential. With a CVSS score of 9.8 and an EPSS score of 94.17%, it is one of the most actively exploited NAS vulnerabilities ever tracked.
Can I change the hard-coded credential to fix this?
No. The messagebus credential is embedded in the device firmware and cannot be changed through the NAS administration interface or any configuration method. Since all affected devices are end-of-life, no firmware update will be released to remove it. The only effective remediation is to retire the affected device.
How is CVE-2024-3272 related to CVE-2024-3273?
CVE-2024-3272 (hard-coded credentials) and CVE-2024-3273 (command injection) affect the same D-Link NAS devices and the same /cgi-bin/nas_sharing.cgi endpoint. Attackers commonly chain both vulnerabilities: using the hard-coded credential to bypass authentication, then exploiting the command injection to execute arbitrary code on the device.
How many D-Link NAS models are affected?
Over 20 D-Link NAS models are affected, including DNS-120, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04, and several DNR-series models. D-Link has confirmed all are end-of-life.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.