{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3273", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-04-03T18:21:32.401Z", "datePublished": "2024-04-04T01:00:06.842Z", "dateUpdated": "2025-10-21T23:05:22.196Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-11T09:43:52.051Z"}, "title": "D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Command Injection"}]}], "affected": [{"vendor": "D-Link", "product": "DNS-320L", "versions": [{"version": "20240403", "status": "affected"}], "modules": ["HTTP GET Request Handler"]}, {"vendor": "D-Link", "product": "DNS-325", "versions": [{"version": "20240403", "status": "affected"}], "modules": ["HTTP GET Request Handler"]}, {"vendor": "D-Link", "product": "DNS-327L", "versions": [{"version": "20240403", "status": "affected"}], "modules": ["HTTP GET Request Handler"]}, {"vendor": "D-Link", "product": "DNS-340L", "versions": [{"version": "20240403", "status": "affected"}], "modules": ["HTTP GET Request Handler"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced."}, {"lang": "de", "value": "Es wurde eine Schwachstelle in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L bis 20240403 gefunden. Sie wurde als kritisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Datei /cgi-bin/nas_sharing.cgi der Komponente HTTP GET Request Handler. Durch die Manipulation des Arguments system mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "timeline": [{"time": "2024-04-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-04-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-04-11T11:48:46.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "netsecfish", "type": "finder"}, {"lang": "en", "value": "netsecfish (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.259284", "name": "VDB-259284 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.259284", "name": "VDB-259284 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.304661", "name": "Submit #304661 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account", "tags": ["third-party-advisory"]}, {"url": "https://github.com/netsecfish/dlink", "tags": ["exploit"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["related"]}], "tags": ["unsupported-when-assigned"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3273", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-12T04:00:37.894213Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-04-11", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273"}}}], "affected": [{"cpes": ["cpe:2.3:a:dlink:dns-320l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-320l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-325_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-325_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-327l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-327l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-340l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-340l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273", "tags": ["government-resource"]}], "timeline": [{"time": "2024-04-11T00:00:00.000Z", "lang": "en", "value": "CVE-2024-3273 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T23:05:22.196Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:08.255Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.259284", "name": "VDB-259284 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.259284", "name": "VDB-259284 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://vuldb.com/?submit.304661", "name": "Submit #304661 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://github.com/netsecfish/dlink", "tags": ["exploit", "x_transferred"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["related", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.259284", "name": "VDB-259284 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.259284", "name": "VDB-259284 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://vuldb.com/?submit.304661", "name": "Submit #304661 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://github.com/netsecfish/dlink", "tags": ["exploit", "x_transferred"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["related", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:08.255Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3273", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-12T04:00:37.894213Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-04-11", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273"}}}], "affected": [{"cpes": ["cpe:2.3:a:dlink:dns-320l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-320l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-325_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-325_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-327l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-327l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dlink:dns-340l_firmware:20240403:*:*:*:*:*:*:*"], "vendor": "dlink", "product": "dns-340l_firmware", "versions": [{"status": "affected", "version": "20240403"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2024-04-11T00:00:00.000Z", "value": "CVE-2024-3273 added to CISA KEV"}], "references": [{"url": "https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273", "tags": ["government-resource"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T16:00:11.023Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "credits": [{"lang": "en", "type": "finder", "value": "netsecfish"}, {"lang": "en", "type": "reporter", "value": "netsecfish (VulDB User)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "affected": [{"vendor": "D-Link", "modules": ["HTTP GET Request Handler"], "product": "DNS-320L", "versions": [{"status": "affected", "version": "20240403"}]}, {"vendor": "D-Link", "modules": ["HTTP GET Request Handler"], "product": "DNS-325", "versions": [{"status": "affected", "version": "20240403"}]}, {"vendor": "D-Link", "modules": ["HTTP GET Request Handler"], "product": "DNS-327L", "versions": [{"status": "affected", "version": "20240403"}]}, {"vendor": "D-Link", "modules": ["HTTP GET Request Handler"], "product": "DNS-340L", "versions": [{"status": "affected", "version": "20240403"}]}], "timeline": [{"lang": "en", "time": "2024-04-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-04-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-04-11T11:48:46.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.259284", "name": "VDB-259284 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.259284", "name": "VDB-259284 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.304661", "name": "Submit #304661 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account", "tags": ["third-party-advisory"]}, {"url": "https://github.com/netsecfish/dlink", "tags": ["exploit"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced."}, {"lang": "de", "value": "Es wurde eine Schwachstelle in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L bis 20240403 gefunden. Sie wurde als kritisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Datei /cgi-bin/nas_sharing.cgi der Komponente HTTP GET Request Handler. Durch die Manipulation des Arguments system mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-11T09:43:52.051Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3273", "state": "PUBLISHED", "dateUpdated": "2025-10-21T23:05:22.196Z", "dateReserved": "2024-04-03T18:21:32.401Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-04-04T01:00:06.842Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"cisaActionDue": "2024-05-02", "cisaExploitAdd": "2024-04-11", "cisaRequiredAction": "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "cisaVulnerabilityName": "D-Link Multiple NAS Devices Command Injection Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*", "matchCriteriaId": "9F733CFC-CB96-46B0-AE7E-21822560C774", "vulnerable": true}, {"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*", "matchCriteriaId": "93290C71-4CDF-4645-AB29-49E832AE6BF4", "vulnerable": true}, {"criteria": "cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "91A5ABBE-0AC8-47CB-B420-3C68020B9132", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C677E53-6885-4EC4-A7CC-E24E8F445F59", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "C44BE2C6-BF3E-43C3-B32F-2DCE756F94BC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*", "matchCriteriaId": "6E161E54-2FE9-4359-9B2D-8700D00DE8E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "96195649-172A-4C21-AA15-7B05F86C5CEC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*", "matchCriteriaId": "07A92F2C-16FD-4A53-8066-83FEC2818DF5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "A8CFCD7B-EFFB-4FAB-9537-46AC7B567126", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*", "matchCriteriaId": "03C5CED7-55A7-4026-95CD-A2ADB5853823", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "4452F9A4-3A0A-4773-9818-04C94CF9F8E7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*", "matchCriteriaId": "A0F5355E-F68D-49FE-9793-1FD9BD9AF3E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FE78C5B-2A98-47EE-BF67-CF58AFE50A37", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*", "matchCriteriaId": "45467ABC-BAA9-4EB0-9F97-92E31854CA8B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC28053F-88A9-4CA1-A2A2-CC90FEEA68FC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A278BC9-6197-43D9-93C2-3DF760856FB7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD3AD5EE-8E1E-4336-A1AB-AB028CC71286", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*", "matchCriteriaId": "5DAF62A4-2429-4B89-8FAD-8B23EF15E050", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "641CB5F1-3DE0-480B-95A4-FC42A8FF3C97", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*", "matchCriteriaId": "94ED678A-AB4C-4637-B0D8-C232A0BB5D5F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*", "matchCriteriaId": "F42F8AA8-30F9-46D9-92D9-CF8876E04FFA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*", "matchCriteriaId": "8042169D-D9FA-4BD6-90D1-E0DE269E42B9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B5E6F048-D865-4378-87C7-B0E528134276", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*", "matchCriteriaId": "D26F4F77-A6E3-4D7D-A781-BEB5FF7BC44F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*", "matchCriteriaId": "288DA5DF-BC45-4B81-82C6-9E78417F415B", "vulnerable": true}, {"criteria": "cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*", "matchCriteriaId": "45D36608-4CCB-4B4F-AC7C-AB925817FF83", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB305B29-7F89-4A52-9ECF-3DB0BDD2350D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "816E5F34-CE76-49E5-91F3-8CC84C561558", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*", "matchCriteriaId": "33CB308B-CF82-4E40-B2DC-23EBD48CD130", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*", "matchCriteriaId": "9A2A09C0-1495-4999-A2B2-CE3474A02CC8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*", "matchCriteriaId": "0646B20C-5642-4CEA-A96C-7E82AD94A281", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD656642-EDD4-4EB2-81AB-04207BC14196", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*", "matchCriteriaId": "F968791D-D3BD-442C-818E-4E878B12776D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "12C5E2D7-018E-4ED1-92C7-B5B1D8CC6990", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7E56821-7EA0-4CA1-BA17-7FD4ED9F794C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A74D270-9076-474D-A06F-C915FCEA2164", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*", "matchCriteriaId": "75E5010F-21BA-4B6B-B00C-2688268FD67B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CAFE1E3-B705-4CF1-AEB9-A474432B6D34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5D08ED7-3E7F-4D30-890E-6535F6C34682", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "42DA6DEB-3578-44A5-916F-1628141F0DDE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*", "matchCriteriaId": "D042C75D-6731-46B2-B11E-A009B9029B3F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2C1EF70-AD9B-48D7-8DF6-A6416C517F12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*", "matchCriteriaId": "E691E775-382C-4BA9-AA44-FBC3148D3E54", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced."}, {"lang": "es", "value": "** NO SOPORTADO CUANDO SE ASIGN\u00d3 ** Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en D-Link DNS-320L, DNS-325, DNS-327L y DNS-340L hasta 20240403. Una funci\u00f3n desconocida del archivo / cgi-bin/nas_sharing.cgi del componente HTTP GET Request Handler. La manipulaci\u00f3n del SYSTEM de argumentos conduce a la inyecci\u00f3n de comandos. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-259284. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. NOTA: Se contact\u00f3 primeramente con el proveedor y se confirm\u00f3 de inmediato que el producto ha llegado al final de su vida \u00fatil. Deber\u00eda retirarse y reemplazarse."}], "id": "CVE-2024-3273", "lastModified": "2025-10-30T19:53:04.050", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-04T01:15:50.387", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/netsecfish/dlink"}, {"source": "cna@vuldb.com", "tags": ["Vendor Advisory"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.259284"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.259284"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.304661"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/netsecfish/dlink"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.259284"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.259284"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.304661"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory"], "url": "https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{}