How severe is CVE-2024-3273?

CVE-2024-3273 has a CVSS 2.0 base score of 7.5 (HIGH). EPSS estimates a 100.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2024-3273: D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET

CISA Known Exploited Vulnerabilities

D-Link Multiple NAS Devices Command Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2024-04-11

Remediation due

2024-05-02

Required action
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

CISA notes
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Severity

CVSS 3.1 · CNA7.3 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS 3.0 · CNA7.3 HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS 2.0 · CNA7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
D-Link	DNS-320L	20240403
D-Link	DNS-325	20240403
D-Link	DNS-327L	20240403
D-Link	DNS-340L	20240403

References

5 Links

Exploits & PoCs

https://github.com/netsecfish/dlink

Third-party advisories

Submit #304661 | D-LINK DNS-340L, DNS-320L, DNS-327L, DNS-325 Version 1.11, Version 1.00.0409.2013, Version 1.09, Version 1.08, Version 1.03.0904.2013, Version 1.01 Command Injection, Backdoor Account

Technical writeups

VDB-259284 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

Detection signatures

VDB-259284 | CTI Indicators (IOB, IOC, TTP, IOA)

Other references

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383

Record Details

Published

2024-04-04

Last updated

2025-10-21

Assigner (CNA)

VulDB

Credited to

netsecfish; netsecfish (VulDB User)

More from D-Link

CVE-2024-327210

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

CVE-2024-07695.3

D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

CVE-2026-41976.5

D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection

CVE-2026-14195.8

D-Link DCS700l Web Form setDayNightMode command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-77 · Command Injection

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.