CVE-2024-3272
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Apr 11, 2024
- US federal agencies must remediate it by May 2, 2024 (BOD 22-01)
- First attack observed 7 days after disclosure
- Confirmed by sensors, not only by reports
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Source: CISA KEV · Aug 25, 2026 Jun 7, 2025 Mar 31, 2025 Aug 29, 2024 Jun 10, 2024 May 24, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| dlink | dns-320l firmware | 1.01.0702.2013 |
| dlink | dns-320l | - |
| dlink | dns-120 firmware | - |
| dlink | dns-120 | - |
| dlink | dnr-202l firmware | - |
| dlink | dnr-202l | - |
| dlink | dns-315l firmware | - |
| dlink | dns-315l | - |
| dlink | dns-320 firmware | - |
| dlink | dns-320 | - |
| dlink | dns-320lw firmware | - |
| dlink | dns-320lw | - |
| dlink | dns-321 | - |
| dlink | dns-321 firmware | - |
| dlink | dnr-322l | - |
| dlink | dnr-322l firmware | - |
| dlink | dns-323 firmware | - |
| dlink | dns-323 | - |
| dlink | dns-325 firmware | 1.01 |
| dlink | dns-325 | - |
| dlink | dns-326 firmware | - |
| dlink | dns-326 | - |
| dlink | dns-327l firmware | 1.00.0409.2013 |
| dlink | dns-327l | - |
| dlink | dnr-326 firmware | - |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.