How severe is CVE-2024-3272?

CVE-2024-3272 has a CVSS 2.0 base score of 10 (HIGH). EPSS estimates a 98.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2024-3272: D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET

CISA Known Exploited Vulnerabilities

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2024-04-11

Remediation due

2024-05-02

Required action
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

CISA notes
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3272

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Severity

CVSS 3.1 · CNA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 3.0 · CNA9.8 CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 · CNA10 HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
D-Link	DNS-320L	20240403
D-Link	DNS-325	20240403
D-Link	DNS-327L	20240403
D-Link	DNS-340L	20240403

References

4 Links

Exploits & PoCs

https://github.com/netsecfish/dlink

Technical writeups

VDB-259283 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

Detection signatures

VDB-259283 | CTI Indicators (IOB, IOC, TTP, IOA)

Other references

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383

Record Details

Published

2024-04-04

Last updated

2025-10-21

Assigner (CNA)

VulDB

Credited to

netsecfish

More from D-Link

CVE-2024-32737.5

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

CVE-2024-07695.3

D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

CVE-2026-41976.5

D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection

CVE-2026-14195.8

D-Link DCS700l Web Form setDayNightMode command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-798 · Use of Hard-coded Credentials

IAM Tools Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.