CVE-2024-3273D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
Updated under an hour ago ()
Does this affect you?
It affects D-Link DNS-320L and 23 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Apr 11, 2024; federal agencies had to remediate by May 2, 2024. Treat that date as your deadline.
Do this next
Free account, 1 product
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness (CWE)
- CWE-77
- Known exploited
- Added to CISA KEV Apr 11, 2024; federal remediation due May 2, 2024This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 100.00% (percentile 100)
- Assigned by
- VulDB
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
D-Link DNS-320L d_link:dns_320l (from the name) | 20240403 | CNA record |
D-Link DNS-325 d_link:dns_325 (from the name) | 20240403 | CNA record |
D-Link DNS-327L d_link:dns_327l (from the name) | 20240403 | CNA record |
D-Link DNS-340L d_link:dns_340l (from the name) | 20240403 | CNA record |
dlink dns-320l_firmware dlink:dns-320l_firmware | 20240403 | CISA ADP |
dlink dns-325_firmware dlink:dns-325_firmware | 20240403 | CISA ADP |
dlink dns-327l_firmware dlink:dns-327l_firmware | 20240403 | CISA ADP |
dlink dns-340l_firmware dlink:dns-340l_firmware | 20240403 | CISA ADP |
dlink dns-320l_firmware dlink:dns-320l_firmware | 1.01.0702.2013; 1.03.0904.2013; 1.11 | NVD |
dlink dns-120_firmware dlink:dns-120_firmware | all versions | NVD |
dlink dnr-202l_firmware dlink:dnr-202l_firmware | all versions | NVD |
dlink dns-315l_firmware dlink:dns-315l_firmware | all versions | NVD |
dlink dns-320_firmware dlink:dns-320_firmware | all versions | NVD |
dlink dns-320lw_firmware dlink:dns-320lw_firmware | all versions | NVD |
dlink dns-321_firmware dlink:dns-321_firmware | all versions | NVD |
dlink dnr-322l_firmware dlink:dnr-322l_firmware | all versions | NVD |
dlink dns-323_firmware dlink:dns-323_firmware | all versions | NVD |
dlink dns-325_firmware dlink:dns-325_firmware | 1.01 | NVD |
dlink dns-326_firmware dlink:dns-326_firmware | all versions | NVD |
dlink dns-327l_firmware dlink:dns-327l_firmware | 1.00.0409.2013; 1.09 | NVD |
dlink dnr-326_firmware dlink:dnr-326_firmware | all versions | NVD |
dlink dns-340l_firmware dlink:dns-340l_firmware | 1.08 | NVD |
dlink dns-343_firmware dlink:dns-343_firmware | all versions | NVD |
dlink dns-345_firmware dlink:dns-345_firmware | all versions | NVD |
dlink dns-726-4_firmware dlink:dns-726-4_firmware | all versions | NVD |
dlink dns-1100-4_firmware dlink:dns-1100-4_firmware | all versions | NVD |
dlink dns-1200-05_firmware dlink:dns-1200-05_firmware | all versions | NVD |
dlink dns-1550-04_firmware dlink:dns-1550-04_firmware | all versions | NVD |
References
- https://vuldb.com/?id.259284vdb-entry, technical-description, third-party-advisory
- https://vuldb.com/?ctiid.259284signature, permissions-required, vdb-entry
- https://vuldb.com/?submit.304661third-party-advisory, vdb-entry
- https://github.com/netsecfish/dlinkexploit, third-party-advisory
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383related, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273us-government-resource
- https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wildthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.