CVE-2024-3272

🗓️ 04 Apr 2024 01:00:05Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 243 Views🌐 WEB

A critical vulnerability in D-Link DNS series, allowing remote attack to obtain hard-coded credential

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Use of Hard-coded Credentials in Dlink Dns-320L_Firmware	21 May 202408:40	–	githubexploit
ATTACKERKB	CVE-2024-3272	4 Apr 202400:00	–	attackerkb
Circl	CVE-2024-3272	8 Apr 202413:56	–	circl
CISA KEV Catalog	D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability	11 Apr 202400:00	–	cisa_kev
CISA KEV Catalog	D-Link Multiple NAS Devices Command Injection Vulnerability	11 Apr 202400:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	11 Apr 202412:00	–	cisa
CNNVD	D-Link DNS-320 信任管理问题漏洞	4 Apr 202400:00	–	cnnvd
Cvelist	CVE-2024-3272 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials	4 Apr 202401:00	–	cvelist
Nuclei	D-Link Network Attached Storage - Backdoor Account	14 May 202603:20	–	nuclei
NVD	CVE-2024-3272	4 Apr 202401:15	–	nvd

NVD

Vulners

Vulnrichment

Node

dlink dns-320l_firmwareMatch1.01.0702.2013

dlink dns-320l_firmwareMatch1.03.0904.2013

dlink dns-320l_firmwareMatch1.11

AND

dlink dns-320lMatch-

Node

dlink dns-120_firmwareMatch-

AND

dlink dns-120Match-

Node

dlink dnr-202l_firmwareMatch-

AND

dlink dnr-202lMatch-

Node

dlink dns-315l_firmwareMatch-

AND

dlink dns-315lMatch-

Node

dlink dns-320_firmwareMatch-

AND

dlink dns-320Match-

Node

dlink dns-320lw_firmwareMatch-

AND

dlink dns-320lwMatch-

Node

dlink dns-321Match-

AND

dlink dns-321_firmwareMatch-

Node

dlink dnr-322lMatch-

AND

dlink dnr-322l_firmwareMatch-

Node

dlink dns-323_firmwareMatch-

AND

dlink dns-323Match-

Node

dlink dns-325_firmwareMatch1.01

AND

dlink dns-325Match-

Node

dlink dns-326_firmwareMatch-

AND

dlink dns-326Match-

Node

dlink dns-327l_firmwareMatch1.00.0409.2013

dlink dns-327l_firmwareMatch1.09

AND

dlink dns-327lMatch-

Node

dlink dnr-326_firmwareMatch-

AND

dlink dnr-326Match-

Node

dlink dns-340l_firmwareMatch1.08

AND

dlink dns-340lMatch-

Node

dlink dns-343Match-

AND

dlink dns-343_firmwareMatch-

Node

dlink dns-345Match-

AND

dlink dns-345_firmwareMatch-

Node

dlink dns-726-4Match-

AND

dlink dns-726-4_firmwareMatch-

Node

dlink dns-1100-4Match-

AND

dlink dns-1100-4_firmwareMatch-

Node

dlink dns-1200-05Match-

AND

dlink dns-1200-05_firmwareMatch-

Node

dlink dns-1550-04Match-

AND

dlink dns-1550-04_firmwareMatch-

[
  {
    "vendor": "D-Link",
    "product": "DNS-320L",
    "versions": [
      {
        "version": "20240403",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP GET Request Handler"
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-325",
    "versions": [
      {
        "version": "20240403",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP GET Request Handler"
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-327L",
    "versions": [
      {
        "version": "20240403",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP GET Request Handler"
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-340L",
    "versions": [
      {
        "version": "20240403",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP GET Request Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
supportannouncement	www.supportannouncement.us.dlink.com/security/publication.aspx
github	www.github.com/netsecfish/dlink
vuldb	www.vuldb.com/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
user	query param	/cgi-bin/nas_sharing.cgi	Vulnerability in D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L allowing manipulation of the user parameter via the CGI script, enabling exploitation through HTTP GET requests.	CWE-798