D-Link Multiple NAS Devices Command Injection Vulnerability

Summary

CVE	CVE-2024-3273
State	PUBLISHED
Assigner	Unknown
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-04-04 01:15:00 UTC
Updated	2024-04-04 04:15:00 UTC
Description	D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

EPSS: 0.999970000 probability, percentile 0.999880000 (date 2026-07-22)

CISA KEV: Listed on 2024-04-11; due 2024-05-02; ransomware use Unknown

Problem Types: CWE-77

Vendor	D-Link
Product	Multiple NAS Devices
Name	D-Link Multiple NAS Devices Command Injection Vulnerability
Required Action	This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Notes	https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273

There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.

Reference	Source	Link	Tags
github.com/netsecfish/dlink		github.com
VDB-259284 \| D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection		vuldb.com
Submit #304661 \| D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account		vuldb.com
VDB-259284 \| CTI Indicators (IOB, IOC, TTP, IOA)		vuldb.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

No vendor comments have been submitted for this CVE.