Critical Vulnerability in D-Link NAS Devices Due to Hard-Coded Credentials

What changed

A serious vulnerability has been discovered in several D-Link NAS devices, specifically the DNS-320L, DNS-325, DNS-327L, and DNS-340L models, which are affected up to April 3, 2024. This vulnerability stems from the use of hard-coded credentials within the HTTP GET Request Handler component, particularly in the file /cgi-bin/nas_sharing.cgi. The flaw allows for remote exploitation by manipulating the user argument with a specific input.

This issue has been publicly disclosed, raising concerns about the potential for unauthorized access and control over affected devices.

Who is affected

The vulnerability impacts several D-Link NAS devices that are no longer supported, posing a significant risk to users who continue to operate these products. Organizations using these devices should be particularly vigilant.

Given the nature of the vulnerability, any entity relying on these D-Link models for data storage and sharing could be at risk.

• D-Link DNS-320L
• D-Link DNS-325
• D-Link DNS-327L
• D-Link DNS-340L

What to do

Organizations using the affected D-Link NAS devices should take immediate action to mitigate risks associated with this vulnerability. Given that these products are no longer supported, it is advisable to consider upgrading to newer, supported models that do not have this critical flaw.

Additionally, users should review their network security measures and consider implementing stricter access controls to limit exposure.

• Upgrade to supported NAS devices.
• Implement network segmentation to isolate vulnerable devices.
• Review and enhance access control policies.