Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 100.0%; technical severity is CVSS 9.8.
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Who should care
- Teams operating Multiple NAS Devices, Dnr-202l Firmware, Dnr-322l Firmware +18 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Multiple NAS Devices, Dnr-202l Firmware, Dnr-322l Firmware +18 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-77
- Affected versions
- D-Link Multiple NAS Devices; Dlink Dnr-202l Firmware (Version: -); Dlink Dnr-322l Firmware (Version: -); Dlink Dnr-326 Firmware (Version: -); Dlink Dns-1100-4 Firmware (Version: -); Dlink Dns-120 Firmware (Version: -); Dlink Dns-1200-05 Firmware (Version: -); Dlink Dns-1550-04 Firmware (Version: -)
- Published
- 3 April 2024
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 100.0%
- Signal calculated at 85