CVE-2024-3273
published 2024-04-04CVE-2024-3273: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-05-02
Exploited in the wild
EPSS
100.00%
100.0th percentile
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dns-320l | — | — |
| d-link | dns-325 | — | — |
| d-link | dns-327l | — | — |
| d-link | dns-340l | — | — |
| dlink | dns-320l_firmware | — | — |
| dlink | dns-320l_firmware | — | — |
| dlink | dns-320l_firmware | — | — |
| dlink | dns-325_firmware | — | — |
| dlink | dns-327l_firmware | — | — |
| dlink | dns-327l_firmware | — | — |
| dlink | dns-340l_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system={{base64(cmd)}}
otherFOFA query: app="D_Link-DNS-ShareCenter"
yara
regex: uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)
- →Exploit sends HTTP GET request to /cgi-bin/nas_sharing.cgi with hardcoded credentials (user=mydlinkBRionyg, passwd=YWJjMTIzNDVjYmE) and a base64-encoded command in the 'system' parameter.
- →Successful exploitation returns HTTP 200 with output matching 'uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)' in the response body, indicating OS command execution.
- →The backdoor account 'messagebus' with an empty password can be chained with the 'system' parameter command injection to achieve unauthenticated RCE. ↗
- →Post-exploitation payload observed is a Mirai variant named skid.x86, indicating botnet/DDoS activity after successful compromise. ↗
- →The command injection is delivered via a base64-encoded payload in the HTTP GET 'system' parameter of the nas_sharing.cgi endpoint. ↗
- ·Affected devices lack automatic update or alert delivery capabilities, so owners cannot be automatically notified of exploitation. ↗
- ·Over 92,000 vulnerable D-Link NAS devices were found exposed online via internet scans at time of disclosure. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-52h8-5hwm-jv8x: A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403
ghsa_unreviewed·2024-04-04
CVE-2024-3273 [HIGH] CWE-77 GHSA-52h8-5hwm-jv8x: A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403
A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
VulnCheck
D-Link Multiple NAS Devices Command Injection Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-3273 [CRITICAL] CWE-77 D-Link Multiple NAS Devices Command Injection Vulnerability
D-Link Multiple NAS Devices Command Injection Vulnerability
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Affected: D-Link Multiple NAS Devices
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Exploitation References: https://infosec.exchange/@greynoise/112236315274772968; https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-09&host_type=src&vulnerability=cve-
CISA
D-Link Multiple NAS Devices Command Injection Vulnerability
cisa·2024-04-11·CVSS 9.8
CVE-2024-3273 [CRITICAL] CWE-77 D-Link Multiple NAS Devices Command Injection Vulnerability
Vulnerability: D-Link Multiple NAS Devices Command Injection Vulnerability
Affected: D-Link Multiple NAS Devices
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Notes: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273
Remediation Due Date: 2024-05-02
Suricata
ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273)
suricata·2024-04-08·CVSS 7.3
CVE-2024-3273 [HIGH] ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273)
ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/nas_sharing.cgi?"; startswith; content:"user|3d|messagebus"; fast_pattern; content:"passwd|3d|"; content:"cmd|3d|15"; content:"system|3d|"; reference:url,supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; reference:cve,2024-3273; classtype:attempted-admin; sid:2051955; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_04_08, cve CVE_2024_3273, deployment P
Nuclei
D-Link Network Attached Storage - Command Injection and Backdoor Account
nuclei·CVSS 9.8
CVE-2024-3273 [CRITICAL] D-Link Network Attached Storage - Command Injection and Backdoor Account
D-Link Network Attached Storage - Command Injection and Backdoor Account
UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Templ
Bleepingcomputer
Critical bug in EoL D-Link NAS devices now exploited in attacks
blogs_bleepingcomputer·2024-11-13·CVSS 9.2
CVE-2024-10914 [CRITICAL] Critical bug in EoL D-Link NAS devices now exploited in attacks
## Critical bug in EoL D-Link NAS devices now exploited in attacks
## Sergiu Gatlan
Attackers now target a critical severity vulnerability with publicly available exploit code that affects multiple models of end-of-life D-Link network-attached storage (NAS) devices.
Tracked as CVE-2024-10914 , the command injection vulnerability was found by security researcher Netsecfish, who also shared exploitation details and said that unauthenticated attackers could exploit it to inject arbitrary shell commands by sending malicious HTTP GET requests to vulnerable NAS devices exposed online.
The affected devices NAS models list includes DNS-320 Version 1.00, DNS-320LW Version 1.01.0914.2012, DNS-325 Version 1.01, Version 1.02, and DNS-340L Version 1.08.
The attacks started after D-Link said on Fr
Bleepingcomputer
D-Link won’t fix critical flaw affecting 60,000 older NAS devices
blogs_bleepingcomputer·2024-11-08·CVSS 9.2
CVE-2024-10914 [CRITICAL] D-Link won’t fix critical flaw affecting 60,000 older NAS devices
## D-Link won’t fix critical flaw affecting 60,000 older NAS devices
## Bill Toulas
More than 60,000 D-Link network-attached storage devices that have reached end-of-life are vulnerable to a command injection vulnerability with a publicly available exploit.
The flaw, tracked as CVE-2024-10914 , has a critical 9.2 severity score and is present in the ‘cgi_user_add’ command where the name parameter is insufficiently sanitized.
An unauthenticated attacker could exploit it to inject arbitrary shell commands by sending specially crafted HTTP GET requests to the devices.
The flaw impacts multiple models of D-Link network-attached storage (NAS) devices that are commonly used by small businesses:
DNS-320 Version 1.00
DNS-320LW Version 1.01.0914.2012
DNS-325 Version 1.01, Version 1.02
DNS-
Checkpoint
15th April – Threat Intelligence Report
blogs_checkpoint·2024-04-15
CVE-2024-29990 15th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 15th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th April, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Japanese optics giant Hoya Corporation has been a victim of a ransomware attack that impacted its major IT infrastructure and various business divisions. Hunters International ransomware gang claimed responsibility for the attack and demanded a ransom of $10M for alleged 1.7M stolen files.
Check Point Harmony Endpoint and Th
Bleepingcomputer
Critical RCE bug in 92,000 D-Link NAS devices now exploited in attacks
blogs_bleepingcomputer·2024-04-08·CVSS 7.3
CVE-2024-3273 [HIGH] Critical RCE bug in 92,000 D-Link NAS devices now exploited in attacks
## Critical RCE bug in 92,000 D-Link NAS devices now exploited in attacks
## Sergiu Gatlan
Image: Midjourney
Attackers are now actively targeting over 92,000 end-of-life D-Link Network Attached Storage (NAS) devices exposed online and unpatched against a critical remote code execution (RCE) zero-day flaw.
As BleepingComputer first reported on Saturday, this security vulnerability ( CVE-2024-3273 ) is the result of a backdoor facilitated through a hardcoded account (username "messagebus" with an empty password) and a command injection issue via the "system" parameter.
Threat actors are now chaining these two security flaws to deploy a variant of the Mirai malware ( skid.x86 ). Mirai variants are usually designed to add infected devices to a botnet that can be used in large-scale distr
Bleepingcomputer
Over 92,000 exposed D-Link NAS devices have a backdoor account
blogs_bleepingcomputer·2024-04-06·CVSS 7.3
[HIGH] Over 92,000 exposed D-Link NAS devices have a backdoor account
## Over 92,000 exposed D-Link NAS devices have a backdoor account
## Bill Toulas
A threat researcher has disclosed a new arbitrary command injection and hardcoded backdoor flaw in multiple end-of-life D-Link Network Attached Storage (NAS) device models.
The researcher who discovered the flaw, 'Netsecfish,' explains that the issue resides within the'/cgi-bin/nas_sharing.cgi' script, impacting its HTTP GET Request Handler component.
The two main issues contributing to the flaw, tracked as CVE-2024-3273 , are a backdoor facilitated through a hardcoded account (username: "messagebus" and empty password) and a command injection problem via the "system" parameter.
When chained together, any attacker can remotely execute commands on the device.
The command injection flaw arises from adding
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Greynoiseio
Storm Watch
blogs_greynoiseio·CVSS 9.8
[CRITICAL] Storm Watch
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
NoiseLetter April 2024
blogs_greynoiseio
NoiseLetter April 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
CVE-2024-3273: D-Link NAS RCE Exploited in the Wild
blogs_greynoiseio·CVSS 9.8
[CRITICAL] CVE-2024-3273: D-Link NAS RCE Exploited in the Wild
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
LLM-Assisted Proactive Threat Intelligence for Automated Reasoning
arxiv_fulltext·2025-04-01
LLM-Assisted Proactive Threat Intelligence for Automated Reasoning
LLM-Assisted Proactive Threat Intelligence for Automated Reasoning
Shuva Paul, Member, IEEE,
Farhad Alemi, Student Member, IEEE,
and Richard Macwan, Member, IEEE
Farhad Alemi is a graduate researcher at Arizona State University.
Shuva Paul and Richard Macwan are researchers at the National Renewable Energy Laboratory, Golden, CO
Journal of \ Class Files, Vol. 14, No. 8, August 2015
Shell et al.: Bare Demo of IEEEtran.cls for IEEE Journals
## Abstract
Successful defense against dynamically evolving cyber threats requires advanced and sophisticated techniques. This research presents a novel approach to enhance real-time cybersecurity threat detection and response by integrating large language models (LLMs) and Retrieval-Augmented Generation (RAG) systems with continuous threat intelligen
arXiv
TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network
arxiv_fulltext·2025-01-28
TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network
TORchlight: Shedding Light on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network
Yumingzhi Pan^ , Zhen Ling^ Corresponding author: Prof. Zhen Ling of Southeast University, China., Yue Zhang^ , Hongze Wang^ , Guangchi Liu^ , Junzhou Luo^ , Xinwen Fu^
^ Southeast University, Email: \pymz, zhenling, wanghongze, gc-liu, jluo\@seu.edu.cn
^ Drexel University, Email: [email protected]
^ University of Massachusetts Lowell, Email: [email protected]
## Abstract
The rapidly expanding Internet of Things (IoT) landscape is shifting toward cloudless architectures, removing reliance on centralized cloud services but exposing devices directly to the internet and increasing their vulnerability to cyberattacks. Our research revealed an unexpected pattern of substantial Tor net
https://github.com/netsecfish/dlinkhttps://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383https://vuldb.com/?ctiid.259284https://vuldb.com/?id.259284https://vuldb.com/?submit.304661https://github.com/netsecfish/dlinkhttps://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383https://vuldb.com/?ctiid.259284https://vuldb.com/?id.259284https://vuldb.com/?submit.304661https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild
2024-04-04
Published
2024-04-11
Added to CISA KEV
Exploited in the wild