Summaryinfo

A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument User with the input messagebus leads to hard-coded credentials. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2024-3272. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to replace the affected component with an alternative. Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects an unknown part of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input value messagebus leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability.

The weakness was presented by netsecfish. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-3272. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/09/2024). The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

The exploit is available at github.com. It is declared as attacked. Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/11/2024 with a due date of 05/02/2024:

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

The problem might be mitigated by replacing the product with as an alternative.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• D-Link

Name

• DNS-320L
• DNS-325
• DNS-327L
• DNS-340L

Version

• 20240403

License

• commercial

Support

• end of life

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion