CVE-2024-3273: D-Link Multiple NAS Devices Command Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-04-11. EPSS: 100% chance of exploitation in the next 30 days.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Affected products

  • D-Link Dnr-202l Firmware: affected versions not specified
  • D-Link DNR-322L Firmware: affected versions not specified
  • D-Link Dnr-326 Firmware: affected versions not specified
  • D-Link DNS-1100-4 Firmware: affected versions not specified
  • D-Link DNS-1200-05 Firmware: affected versions not specified
  • D-Link DNS-120 Firmware: affected versions not specified
  • D-Link DNS-1550-04 Firmware: affected versions not specified
  • D-Link DNS-315l Firmware: affected versions not specified
  • D-Link DNS-320 Firmware: affected versions not specified
  • D-Link DNS-320l Firmware: version 1.01.0702.2013 only; version 1.03.0904.2013 only; version 1.11 only
  • D-Link DNS-320lw Firmware: affected versions not specified
  • D-Link DNS-321 Firmware: affected versions not specified
  • D-Link DNS-323 Firmware: affected versions not specified
  • D-Link DNS-325 Firmware: version 1.01 only
  • D-Link DNS-326 Firmware: affected versions not specified
  • D-Link DNS-327l Firmware: version 1.00.0409.2013 only; version 1.09 only
  • D-Link DNS-340l Firmware: version 1.08 only
  • D-Link DNS-343 Firmware: affected versions not specified
  • D-Link DNS-345 Firmware: affected versions not specified
  • D-Link DNS-726-4 Firmware: affected versions not specified

Published 2024-04-04. Last modified 2026-06-17.