{"id":"CVE-2024-3273","published":"2024-04-04T01:15:50Z","modified":"2026-06-17T07:43:41Z","title":"D-Link Multiple NAS Devices Command Injection Vulnerability","vendor":"D-Link","product":"Multiple NAS Devices","tier":"core","eol":null,"description":{"text":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in the HTTP GET request handler of the /cgi-bin/nas_sharing.cgi component in D-Link's DNS-320L, DNS-325, DNS-327L and DNS-340L NAS devices (up to 20240403) lets attackers control the \"system\" argument to run arbitrary commands. Exploitation requires only network access to the device, with no authentication or user interaction needed, and the affected models are end-of-life and unsupported by the vendor.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:54Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99995,"percentile":0.99988,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-04-11","dueDate":"2024-05-02","ransomware":false,"requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3273","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-04-08","exploitedFirstSeen":"2024-04-08","ransomware":false,"evidence":[{"url":"https://infosec.exchange/@greynoise/112236315274772968","date":"2024-04-08"},{"url":"https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild","date":"2024-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-09&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-10&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-10"},{"url":"https://cyble.com/blog/critical-d-link-nas-vulnerability-under-active-exploitation/","date":"2024-04-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-11&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-04-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-12&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-13&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-15&host_type=src&vulnerability=cve-2024-3273","date":"2024-04-15"}],"evidenceTotal":406,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"skynox7: Proxyjacking Edge Devices Into Residential Proxies","url":"https://otx.alienvault.com/pulse/6ad9e65d5b3dc4f0fcdc04c3","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://github.com/netsecfish/dlink","tags":["Exploit","Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383","tags":["Vendor Advisory"]},{"url":"https://vuldb.com/?ctiid.259284","tags":["Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?id.259284","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?submit.304661","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/netsecfish/dlink","tags":["Exploit","Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383","tags":["Vendor Advisory"]},{"url":"https://vuldb.com/?ctiid.259284","tags":["Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?id.259284","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?submit.304661","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild","tags":["Third Party Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated HTTP request exploits exposed web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"It is possible to launch the attack remotely","start":340,"end":384}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary command execution on device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"The manipulation of the argument system leads to command injection","start":272,"end":338}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-31863","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31863","exploited":true,"exploitedSince":"2024-04-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2024-04-07","earliestUrl":"https://github.com/Chocapikk/CVE-2024-3273","repos":[{"name":"Chocapikk/CVE-2024-3273","url":"https://github.com/Chocapikk/CVE-2024-3273","stars":100,"created":"2024-04-07"},{"name":"adhikara13/CVE-2024-3273","url":"https://github.com/adhikara13/CVE-2024-3273","stars":13,"created":"2024-04-07"},{"name":"Ap0dexMe0/CVE-2024-3273","url":"https://github.com/Ap0dexMe0/CVE-2024-3273","stars":5,"created":"2024-04-10"},{"name":"yarienkiva/honeypot-dlink-CVE-2024-3273","url":"https://github.com/yarienkiva/honeypot-dlink-CVE-2024-3273","stars":0,"created":"2024-04-07"},{"name":"OIivr/Turvan6rkus-CVE-2024-3273","url":"https://github.com/OIivr/Turvan6rkus-CVE-2024-3273","stars":0,"created":"2024-05-05"}]},"nuclei":[{"id":"CVE-2024-3273","name":"D-Link Network Attached Storage - Command Injection and Backdoor Account","severity":"critical","path":"http/cves/2024/CVE-2024-3273.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3273.yaml"}],"first":{"date":"2024-04-07","source":"PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2024-3273"},"provenance":"source"},"exploitRefs":["https://github.com/netsecfish/dlink"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-04-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3273","provenance":"source"},{"date":"2024-04-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2024-3273","provenance":"source"},{"date":"2024-04-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://infosec.exchange/@greynoise/112236315274772968","provenance":"source"},{"date":"2024-04-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-04-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31863","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":7},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 936 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}