10

CVE-2024-3272: D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

CVSS: 10.0v2.0HighKEVAnalyzed
Published 04-04-2024Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2024-3272 is a high (CVSS 10.0) Use of Hard-coded Credentials vulnerability in D-Link Multiple NAS Devices. It is known to be exploited: CISA lists it, first on 11-04-2024. EPSS estimates a 98.11% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
High · v2.0 (CVE.org)
EPSS score
98.11%
0%100%
Critical · +0.07 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 04-04-2024
    PublishedVulnerability first disclosed.
  2. 11-04-2024
    Added to CISA KEVD-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
  3. 02-05-2024
    CISA remediation dueApply mitigations per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS metrics

5 scores · 2 sources · 3 versions

EPSS trend

Probability

98.11%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.07 pp

From 98.04% on 19-09-2026

19-09-202619-10-2026
EPSS score
98.11%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
11-04-2024
Federal due date
02-05-2024

CISA required action

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 nvd.nist.gov/vuln/detail/CVE-2024-3272

Public exploits

1 found
  • githubUnverified

    Dlink

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Dlink20 products
D-link4 products

2 vendors · 24 products

References

5 links