CVE-2024-3273
D-Link Multiple NAS Devices Command Injection Vulnerability
Description
CVE-2024-3273 is a high-severity command injection vulnerability in multiple D-Link NAS devices including the DNS-320L, DNS-325, DNS-327L, and DNS-340L. With a CVSS v3.1 base score of 7.3, this flaw exists in the HTTP GET Request Handler at /cgi-bin/nas_sharing.cgi, where manipulation of the system parameter enables unauthenticated remote command injection. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 2, 2024, and the ransomware association is classified as unknown. The EPSS score of 94.40% at the 100.0th percentile indicates near-universal exploitation of exposed devices. Critically, these devices were designated as end-of-life (unsupported) when the vulnerability was assigned, meaning no patches will be provided by D-Link.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dns-320l firmware | 1.01.0702.2013; 1.03.0904.2013; 1.11 |
| dlink | dns-120 firmware | - |
| dlink | dnr-202l firmware | - |
| dlink | dns-315l firmware | - |
| dlink | dns-320 firmware | - |
| dlink | dns-320lw firmware | - |
| dlink | dns-321 firmware | - |
| dlink | dnr-322l firmware | - |
| dlink | dns-323 firmware | - |
| dlink | dns-325 firmware | 1.01 |
| dlink | dns-326 firmware | - |
| dlink | dns-327l firmware | 1.00.0409.2013; 1.09 |
| dlink | dnr-326 firmware | - |
| dlink | dns-340l firmware | 1.08 |
| dlink | dns-343 firmware | - |
| dlink | dns-345 firmware | - |
| dlink | dns-726-4 firmware | - |
| dlink | dns-1100-4 firmware | - |
| dlink | dns-1200-05 firmware | - |
| dlink | dns-1550-04 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/netsecfish/dlink(Exploit, Third Party Advisory)
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383(Vendor Advisory)
- https://vuldb.com/?ctiid.259284(Permissions Required, VDB Entry)
- https://vuldb.com/?id.259284(Third Party Advisory, VDB Entry)
- https://vuldb.com/?submit.304661(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273(US Government Resource)
- https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild(Third Party Advisory)
Weakness Type
No specific CWE has been assigned to CVE-2024-3273 by NVD. Based on the vulnerability characteristics, this is a command injection flaw (typically classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command). The vulnerability resides in the nas_sharing.cgi script's handling of the system parameter in HTTP GET requests. User-supplied input passed through this parameter is incorporated into operating system commands without proper sanitization or validation, allowing an attacker to inject arbitrary shell commands that execute on the NAS device's underlying Linux operating system. The lack of authentication on the vulnerable endpoint compounds the severity, as any network-reachable attacker can exploit the flaw without credentials.
Impact Analysis
The impact of CVE-2024-3273 spans all aspects of the CIA triad, though the CVSS score reflects reduced per-metric impact compared to full compromise. Confidentiality is partially compromised as the command injection enables the attacker to read files stored on the NAS, including personal documents, photos, backups, and configuration files containing credentials. NAS devices are frequently used as central data repositories in home and small business environments, making them high-value targets for data theft.
Integrity faces partial impact because the attacker can modify or delete files on the NAS, plant malware, alter system configurations, and establish persistent backdoors. The command injection runs in the context of the web server process, which may have limited permissions but typically has sufficient access to read and write user data stored on the device.
Availability is partially impacted as attackers can disrupt NAS services, encrypt stored data for ransom, or recruit the device into botnets for DDoS attacks. The EPSS score of 94.40% at the 100.0th percentile confirms that this is among the most actively exploited vulnerabilities in the entire tracking ecosystem. GreyNoise has confirmed widespread exploitation attempts targeting D-Link NAS devices as documented at their blog analysis. The end-of-life status of all affected devices means no vendor patches will ever be available, leaving exposed devices permanently vulnerable.
Exploit Maturity
CVE-2024-3273 has reached maximum exploit maturity with public exploit code, mass exploitation campaigns, and botnet recruitment activity. The EPSS score of 94.40% at the 100.0th percentile places this at the absolute top of all tracked vulnerabilities in terms of exploitation probability. CISA's KEV listing with a May 2, 2024 deadline confirms active government-level concern about exploitation.
Public exploit code is available on GitHub at netsecfish/dlink, providing ready-to-use exploitation tools. GreyNoise documented mass exploitation campaigns in their analysis at GreyNoise: CVE-2024-3273 D-Link NAS RCE Exploited in the Wild, confirming that botnets are actively scanning for and exploiting vulnerable D-Link NAS devices at scale. D-Link has published a support announcement at D-Link SAP10383 confirming that all affected models are end-of-life and recommending retirement. The combination of trivial exploitation (simple HTTP GET request), public exploit code, mass scanning campaigns, and zero prospect of vendor patches creates a permanently exploitable condition for any exposed device.
Remediation
-
Retire and replace all affected D-Link NAS devices immediately as the definitive solution. All affected models (DNS-320L, DNS-325, DNS-327L, DNS-340L, and over 15 additional models) are end-of-life and will never receive security patches. D-Link's official advisory explicitly recommends replacing these devices. Migrate data to a supported NAS platform from a vendor providing active security updates.
-
Disconnect affected NAS devices from the internet immediately as an emergency measure if replacement cannot happen instantly. Remove any port forwarding rules on the router that expose the NAS web interface (typically ports 80, 443, 8080) to the internet. The vulnerability is remotely exploitable without authentication, so internet exposure equals guaranteed compromise given the 94.40% EPSS score.
-
Isolate the NAS device on a separate network segment if it must remain operational temporarily. Place it on an isolated VLAN with firewall rules restricting access to only trusted internal hosts that need to access the NAS. Block all outbound internet access from the NAS to prevent command-and-control communication if the device has already been compromised.
-
Perform a forensic backup and integrity check of all data on the NAS before migration. Given the mass exploitation campaigns, any internet-exposed affected NAS should be presumed compromised. Verify file integrity against known-good backups, scan copied data for malware, and check for any unauthorized files or modifications on the device.
-
Scan your network for additional vulnerable D-Link devices as CVE-2024-3273 affects over 20 different D-Link NAS models. Use network scanning tools to identify any D-Link NAS devices and cross-reference against the full affected product list in the D-Link advisory. Also check for the related CVE-2024-3272 (hard-coded credentials) which affects the same devices.
Technical Details
CVE-2024-3273 is a command injection vulnerability in D-Link NAS devices, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vector indicates straightforward remote exploitation. Attack Vector (AV:N) confirms the vulnerability is exploitable over the network. Attack Complexity (AC:L) means the exploit is trivially reliable with no special conditions. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) remains unchanged as impact stays within the NAS device context. The Low ratings for confidentiality, integrity, and availability reflect the limited permissions of the web server process, though practical impact may exceed these ratings.
The vulnerability exists in the /cgi-bin/nas_sharing.cgi script that handles HTTP GET requests on affected D-Link NAS devices. The system parameter passed in HTTP GET requests is incorporated into operating system shell commands without adequate input validation or sanitization. An attacker can inject arbitrary shell commands by including shell metacharacters (such as semicolons, backticks, or pipe characters) in the system parameter value. The injected commands execute on the NAS device's embedded Linux operating system in the context of the web server process. The exploitation is as simple as sending a crafted HTTP GET request to the device's web interface, making it trivially automatable for mass scanning and exploitation campaigns. The affected devices run firmware versions up through the April 2024 cutoff date and span over 20 D-Link NAS models from the DNS-120 through the DNS-1550-04 series.
Frequently Asked Questions
What is CVE-2024-3273?
CVE-2024-3273 is a command injection vulnerability in the HTTP GET Request Handler of multiple D-Link NAS devices. It allows unauthenticated remote attackers to execute arbitrary operating system commands through the /cgi-bin/nas_sharing.cgi endpoint, with an EPSS score of 94.40% confirming massive real-world exploitation.
Will D-Link release a patch for this vulnerability?
No. All affected D-Link NAS models have reached end-of-life status and D-Link has confirmed that no patches will be released. The only effective remediation is to retire the affected devices and replace them with actively supported NAS products.
How many D-Link NAS models are affected?
Over 20 D-Link NAS models are affected, including the DNS-120, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04, and their DNR-series variants. The full list is available in D-Link's support announcement.
Is CVE-2024-3273 related to CVE-2024-3272?
Yes, CVE-2024-3272 is a hard-coded credentials vulnerability affecting the same D-Link NAS devices and the same nas_sharing.cgi endpoint. The two vulnerabilities are often exploited together, with the hard-coded credentials providing initial authentication bypass and the command injection enabling arbitrary code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.