CVE-2024-3273

D-Link Multiple NAS Devices Command Injection Vulnerability

Published Apr 3, 2024 · corrected/updated Jun 17, 2026 · dlink dns-320l firmware · evidence confidence very high

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2024-3273 is a critical public vulnerability record for dlink dns-320l firmware. CISA lists it as known exploited. Published remediation guidance: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether dlink dns-320l firmware is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: dlink/dnr-202l firmware; dlink/dnr-322l firmware; dlink/dns-120 firmware; dlink/dns-315l firmware. Published remediation guidance: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 9.8, EPSS 100.0%. CISA lists it as known exploited. Weakness classes: CWE-77. Sources contributing to this record: cisa_kev, cve_org, epss, nvd. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Confirmed in CISA KEV since Apr 11, 2024. Listed in the CISA Known Exploited Vulnerabilities catalog.
Patch and remediation
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. CISA due date May 2, 2024.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Apr 3, 2024 · Catalog
Detected
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit ha
Apr 11, 2024 · CISA KEV
Known exploited
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
May 2, 2024 · CISA KEV
Remediation due
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Jun 17, 2026 · Catalog
Updated
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit ha

Affected

cpe dlink/dnr-202l firmwareversion unspecified
cpe dlink/dnr-322l firmwareversion unspecified
cpe dlink/dns-120 firmwareversion unspecified
cpe dlink/dns-315l firmwareversion unspecified
cpe dlink/dns-320 firmwareversion unspecified
cpe dlink/dns-320l firmware1.01.0702.2013
cpe dlink/dns-320l firmware1.03.0904.2013
cpe dlink/dns-320l firmware1.11
cpe dlink/dns-320lw firmwareversion unspecified
cpe dlink/dns-321 firmwareversion unspecified
cpe dlink/dns-323 firmwareversion unspecified
cpe dlink/dns-325 firmware1.01
vendor D-Link Multiple NAS Devicesversion unspecified

Sources

CISA KEVConfirmed exploitationCVE-2024-3273
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
cisa.gov
CVE.orgVulnerability recordCVE-2024-3273
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2024-3273
30-day exploitation probability 100.0%
first.org
NIST NVDVulnerability recordCVE-2024-3273
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The mani
nvd.nist.gov