dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 2 May 2024.
Dns 320l FirmwareOperating system · Dlink

CVE-2024-3273

CRITICAL · 9.8 CVSS v3.1 Published 2024-04-04
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Public exploit Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A command injection vulnerability in D-Link NAS devices (DNS-320L, DNS-325, DNS-327L, DNS-340L) allows remote unauthenticated attackers to execute arbitrary commands via the 'system' parameter in the /cgi-bin/nas_sharing.cgi component. The flaw is exploitable via HTTP GET requests and has been publicly disclosed, enabling trivial exploitation.

MitigationThese are end-of-life devices with no vendor patch available. Immediate network isolation is recommended, followed by retirement and replacement with supported hardware. If continued operation is required, restrict CGI access to authorized IPs via firewall or disable the service entirely.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Dns 320l FirmwareOperating system
Affected:= 1.01.0702.2013= 1.03.0904.2013= 1.11
Dns 120 FirmwareOperating system
Affected:all versions
Dnr 202l FirmwareOperating system
Affected:all versions
Dns 315l FirmwareOperating system
Affected:all versions
Dns 320 FirmwareOperating system
Affected:all versions
Dns 320lw FirmwareOperating system
Affected:all versions
Dns 321 FirmwareOperating system
Affected:all versions
Dnr 322l FirmwareOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the D-Link NAS model
    Access the device web interface and check the model information in the UI, or inspect HTTP responses from the device for model identification headers. Alternatively, check physical labels or documentation.
    Affected if The device model is DNS-320L, DNS-325, DNS-327L, DNS-340L, DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320lw, DNS-321, or DNR-322L.
  2. Confirm the device firmware version
    Log into the device web interface and navigate to the status or system information page to view the installed firmware version.
    Affected if The firmware version matches 1.01.0702.2013, 1.03.0904.2013, or 1.11 for DNS-320L, or is any version for the other affected models.
  3. Verify the web interface is accessible
    Attempt to access the device IP address via HTTP on port 80 or HTTPS on port 443. Confirm the D-Link NAS login page loads.
    Affected if The device web interface responds to HTTP/HTTPS requests, indicating the CGI service is active.
  4. Confirm the vulnerable CGI endpoint exists
    Send a GET request to http://<device-ip>/cgi-bin/nas_sharing.cgi and verify the script responds or returns an error indicating it exists.
    Affected if The /cgi-bin/nas_sharing.cgi endpoint responds to requests.
  5. Check if the system parameter is accepted
    Send a crafted GET request to /cgi-bin/nas_sharing.cgi with a test value in the 'system' parameter, such as '?system=test', and observe if the parameter is processed or reflected in the response.
    Affected if The 'system' parameter is accepted and processed by the nas_sharing.cgi script.

If the device is an affected D-Link NAS model with the web interface accessible and the nas_sharing.cgi script accepts the 'system' parameter, the environment is vulnerable to unauthenticated command injection.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

These are end-of-life devices with no vendor patch available. Immediate network isolation is recommended, followed by retirement and replacement with supported hardware. If continued operation is required, restrict CGI access to authorized IPs via firewall or disable the service entirely.

Recommended fix High confidence
  1. 1. Immediately isolate affected devices from the network to prevent exploitation
  2. 2. Cease use of D-Link DNS-320L, DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320LW, DNS-321, and DNR-322L devices as they are end-of-life and receive no security updates
  3. 3. Replace affected devices with currently supported hardware from a vendor that provides regular security patches
  4. 4. If continued use is absolutely required, implement network segmentation to limit exposure and monitor for suspicious activity targeting the /cgi-bin/nas_sharing.cgi endpoint
  5. 5. Review CISA advisory for additional mitigation recommendations at cisa.gov
Caveat No upgrade path available - vendor explicitly states these products are end-of-life and should be retired and replaced

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Dns 320l Firmware Exploited in the wild — priority engagement
  • Consultation8.0 h
  • Implementation16.0 h
  • Testing8.0 h
  • Review / QA4.0 h
36.0 hours of engineering $6,400
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $10,240.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-3273 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-3273 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data