CVE-2024-3272

Опубликовано: 04 апр. 2024

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Ссылки

https://github.com/netsecfish/dlink
Exploit
Third Party Advisory
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
Vendor Advisory
https://vuldb.com/?ctiid.259283
Permissions Required
https://vuldb.com/?id.259283
Third Party Advisory
https://github.com/netsecfish/dlink
Exploit
Third Party Advisory
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
Vendor Advisory
https://vuldb.com/?ctiid.259283
Permissions Required
https://vuldb.com/?id.259283
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*

Конфигурация 12

Одновременно

Одно из

cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*

Конфигурация 13

Одновременно

cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*

Конфигурация 14

Одновременно

cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*

Конфигурация 15

Одновременно

cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*

Конфигурация 16

Одновременно

cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*

Конфигурация 17

Одновременно

cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*

Конфигурация 18

Одновременно

cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*

Конфигурация 19

Одновременно

cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*

Конфигурация 20

Одновременно

cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*

cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.94168

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-qr33-7mgh-rqvr

CVSS3: 9.8

github

почти 2 года назад

BDU:2024-03256

CVSS3: 9.8

fstec

почти 2 года назад

Уязвимость CGI-скрипта nas_sharing.cgi микропрограммного обеспечения устройств NAS D-Link DNS-320L, DNS-325, DNS-327L и DNS-340L, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.94168

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-798