CVE-2024-3273

D-Link Multiple NAS Devices Command Injection Vulnerability

Dns-320L Firmware

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this…

4. Apr 2024

Ausgewertete Quellen

• Hersteller
  https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
• Hinweis
  https://vuldb.com/?id.259284
• Hinweis
  https://vuldb.com/?submit.304661
• Hinweis
  https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273
• CISA
  D-Link Multiple NAS Devices Command Injection Vulnerability
• NVD
  CVE-2024-3273
• GitHub
  https://github.com/netsecfish/dlink