CVE-2024-3272
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
D-Link Multiple NAS Devices
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 11 April 2024. US federal agencies were required to remediate it by 2 May 2024.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 98.1%, which is higher than 99.9% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently asked questions
Is CVE-2024-3272 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2024-3272.
What does CVE-2024-3272 affect?
CVE-2024-3272 affects D-Link Multiple NAS Devices. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
How severe is CVE-2024-3272?
CVE-2024-3272 is rated CRITICAL with a CVSS base score of 9.8. EPSS puts the probability of exploitation in the next 30 days at 98.1%, higher than 99.9% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2 May 2024.
How should organisations respond to CVE-2024-3272?
Apply the vendor patch for D-Link Multiple NAS Devices as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.