Research · Apr 3, 2024
Critical Vulnerability Discovered in D-Link NAS Devices Due to Hard-Coded Credentials
A serious vulnerability affecting several D-Link NAS devices has been identified, stemming from hard-coded credentials that could be exploited remotely.
What changed
A critical vulnerability has been uncovered in multiple D-Link NAS devices, specifically the DNS-320L, DNS-325, DNS-327L, and DNS-340L models. This issue arises from the use of hard-coded credentials within the HTTP GET Request Handler component, specifically in the processing of the file /cgi-bin/nas_sharing.cgi.
This vulnerability allows remote attackers to exploit the system by manipulating the user argument, potentially compromising device security.
Who is affected
The vulnerability impacts several models of D-Link NAS devices that are no longer supported. Users of these devices should be particularly vigilant.
Organizations and individuals utilizing the following products are at risk:
- D-Link DNS-320L
- D-Link DNS-325
- D-Link DNS-327L
- D-Link DNS-340L
What to do
Given the critical nature of this vulnerability, users are advised to take immediate action to safeguard their systems. Regularly updating and monitoring device security is essential.
While these specific devices are no longer supported, consider the following steps:
- Review device configurations and access controls.
- Consider replacing unsupported devices with newer models that receive regular security updates.
- Monitor network traffic for any unusual activity that may indicate exploitation attempts.