D-Link Multiple NAS Devices Command Injection Vulnerability
Description
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
What to do
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Turn on D-Link alerts
Details
- Vendor
- D-Link
- Product
- D-Link DNS-320L, DNS-325, DNS-327L, DNS-340L
- CVE
- CVE-2024-3273
- Affected versions
- DNS-320L: 1.01.0702.2013, 1.03.0904.2013, 1.11 (up to 20240403)
DNS-325: 1.01 (up to 20240403)
DNS-327L: 1.00.0409.2013, 1.09 (up to 20240403)
DNS-340L: 1.08 (up to 20240403)
DNS-120: version not specified
DNR-202L: version not specified
DNS-315L: version not specified
DNS-320: version not specified
DNS-320LW: version not specified
DNS-321: version not specified
DNR-322L: version not specified
DNS-323: version not specified
DNS-326: version not specified
DNR-326: version not specified
DNS-343: version not specified
DNS-345: version not specified
DNS-726-4: version not specified
DNS-1100-4: version not specified
DNS-1200-05: version not specified
DNS-1550-04: version not specified (from the advisory and NVD; check the exact builds in the official advisory) - CVSS score
- 7.3
- Actively exploited
- Yes, listed in the CISA Known Exploited Vulnerabilities catalog
- CISA due date
- May 2, 2024 (deadline for US federal agencies: a good benchmark for you too)
- Source
- CISA KEV – original advisory
- Published
- April 11, 2024
The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.