Strix
26.1K

CVE-2024-3272

CRITICALCVSS 9.8/10Actively ExploitedEPSS 98.04%

Last modified

CVE-2024-3272 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. CISA has confirmed active exploitation in the wild. EPSS estimates a 98.04% chance of exploitation in the next 30 days.

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
98.04%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersions
DlinkDns-320l Firmware1.01.0702.2013
DlinkDns-320l Firmware1.03.0904.2013
DlinkDns-320l Firmware1.11
DlinkDns-120 FirmwareAll versions
DlinkDnr-202l FirmwareAll versions
DlinkDns-315l FirmwareAll versions
DlinkDns-320 FirmwareAll versions
DlinkDns-320lw FirmwareAll versions
DlinkDns-321 FirmwareAll versions
DlinkDnr-322l FirmwareAll versions
DlinkDns-323 FirmwareAll versions
DlinkDns-325 Firmware1.01
DlinkDns-326 FirmwareAll versions
DlinkDns-327l Firmware1.00.0409.2013
DlinkDns-327l Firmware1.09
DlinkDnr-326 FirmwareAll versions
DlinkDns-340l Firmware1.08
DlinkDns-343 FirmwareAll versions
DlinkDns-345 FirmwareAll versions
DlinkDns-726-4 FirmwareAll versions
DlinkDns-1100-4 FirmwareAll versions
DlinkDns-1200-05 FirmwareAll versions
DlinkDns-1550-04 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2024-3272?
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
How severe is CVE-2024-3272?
CVE-2024-3272 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 98.04% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2024-3272?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-3272?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST