Research · Apr 3, 2024
Critical Command Injection Vulnerability Discovered in D-Link NAS Devices
A critical command injection vulnerability has been identified in multiple D-Link NAS devices, affecting models that are no longer supported.
What changed
A serious vulnerability has been uncovered in several D-Link NAS devices, which allows for command injection through a specific HTTP GET request. This vulnerability affects devices that have not received support since April 2024.
- The vulnerability is classified as critical and has been assigned the identifier VDB-259284.
- Exploiting this vulnerability could allow remote attackers to execute arbitrary commands on the affected devices.
- The affected component is the HTTP GET Request Handler found in the /cgi-bin/nas_sharing.cgi file.
Who is affected
The following D-Link NAS models are impacted by this vulnerability, all of which are no longer supported by the vendor:
Users of these devices should be aware of the potential risks associated with their continued use.
- D-Link DNS-320L
- D-Link DNS-325
- D-Link DNS-327L
- D-Link DNS-340L
What to do
Given that these devices are no longer supported, users should consider the following actions to mitigate risks:
It's crucial to evaluate alternative solutions or upgrade to supported models to ensure ongoing security.
- Immediately assess the necessity of continuing to use affected models.
- Consider replacing unsupported devices with newer models that receive regular security updates.
- Implement network segmentation to limit exposure of vulnerable devices.