9.8
CVE-2024-3273
- EPSS 94.43%
- Veröffentlicht 04.04.2024 01:15:50
- Zuletzt bearbeitet 30.07.2025 19:25:17
- Quelle cna@vuldb.com
- Teams Watchlist Login
- Unerledigt Login
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dns-320l Firmware Version1.01.0702.2013
Dlink ≫ Dns-320l Firmware Version1.03.0904.2013
Dlink ≫ Dns-320l Firmware Version1.11
Dlink ≫ Dns-120 Firmware Version-
Dlink ≫ Dnr-202l Firmware Version-
Dlink ≫ Dns-315l Firmware Version-
Dlink ≫ Dns-320 Firmware Version-
Dlink ≫ Dns-320lw Firmware Version-
Dlink ≫ Dns-321 Firmware Version-
Dlink ≫ Dnr-322l Firmware Version-
Dlink ≫ Dns-323 Firmware Version-
Dlink ≫ Dns-325 Firmware Version1.01
Dlink ≫ Dns-326 Firmware Version-
Dlink ≫ Dns-327l Firmware Version1.00.0409.2013
Dlink ≫ Dns-327l Firmware Version1.09
Dlink ≫ Dnr-326 Firmware Version-
Dlink ≫ Dns-340l Firmware Version1.08
Dlink ≫ Dns-343 Firmware Version-
Dlink ≫ Dns-345 Firmware Version-
Dlink ≫ Dns-726-4 Firmware Version-
Dlink ≫ Dns-1100-4 Firmware Version-
Dlink ≫ Dns-1200-05 Firmware Version-
Dlink ≫ Dns-1550-04 Firmware Version-
11.04.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog
D-Link Multiple NAS Devices Command Injection Vulnerability
SchwachstelleD-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
BeschreibungThis vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 94.43% | 1 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| cna@vuldb.com | 7.3 | 3.9 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
|
| cna@vuldb.com | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.