{"history":[{"alert":0,"cve":"CVE-2024-3272","id":22717,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.98109, \"percentile\": 0.99912}"},{"alert":0,"cve":"CVE-2024-3272","id":20337,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":18146,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":16210,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":14188,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":11970,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":9956,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":0,"cve":"CVE-2024-3272","id":7505,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.98109, \"percentile\": 0.99911}"},{"alert":1,"cve":"CVE-2024-3272","id":6097,"kind":"cna","observed_at":1793766000,"payload":"{\"containers\": {\"adp\": [{\"affected\": [{\"cpes\": [\"cpe:2.3:o:dlink:dns-320l_firmware:-:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"dns-320l_firmware\", \"vendor\": \"dlink\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"cpes\": [\"cpe:2.3:o:dlink:dns-325_firmware:-:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"dns-325_firmware\", \"vendor\": \"dlink\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"cpes\": [\"cpe:2.3:o:dlink:dns-327l_firmware:-:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"dns-327l_firmware\", \"vendor\": \"dlink\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"cpes\": [\"cpe:2.3:o:dlink:dns-340l_firmware:-:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"dns-340l_firmware\", \"vendor\": \"dlink\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}], \"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2024-3272\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2024-04-12T04:00:39.050176Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2024-04-11\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:05:22.378Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-04-11T00:00:00.000Z\", \"value\": \"CVE-2024-3272 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}, {\"providerMetadata\": {\"dateUpdated\": \"2024-08-01T20:05:08.352Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"name\": \"VDB-259283 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials\", \"tags\": [\"vdb-entry\", \"technical-description\", \"x_transferred\"], \"url\": \"https://vuldb.com/?id.259283\"}, {\"name\": \"VDB-259283 | CTI Indicators (IOB, IOC, TTP, IOA)\", \"tags\": [\"signature\", \"permissions-required\", \"x_transferred\"], \"url\": \"https://vuldb.com/?ctiid.259283\"}, {\"tags\": [\"exploit\", \"x_transferred\"], \"url\": \"https://github.com/netsecfish/dlink\"}, {\"tags\": [\"related\", \"x_transferred\"], \"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"modules\": [\"HTTP GET Request Handler\"], \"product\": \"DNS-320L\", \"vendor\": \"D-Link\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"modules\": [\"HTTP GET Request Handler\"], \"product\": \"DNS-325\", \"vendor\": \"D-Link\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"modules\": [\"HTTP GET Request Handler\"], \"product\": \"DNS-327L\", \"vendor\": \"D-Link\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}, {\"modules\": [\"HTTP GET Request Handler\"], \"product\": \"DNS-340L\", \"vendor\": \"D-Link\", \"versions\": [{\"status\": \"affected\", \"version\": \"20240403\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"netsecfish\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.\"}, {\"lang\": \"de\", \"value\": \"Eine Schwachstelle wurde in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L bis 20240403 entdeckt. Sie wurde als sehr kritisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei /cgi-bin/nas_sharing.cgi der Komponente HTTP GET Request Handler. Mit der Manipulation des Arguments user mit der Eingabe messagebus mit unbekannten Daten kann eine hard-coded credentials-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \\u00fcber das Netzwerk erfolgen. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"cvssV3_0\": {\"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.0\"}}, {\"cvssV2_0\": {\"baseScore\": 10, \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"version\": \"2.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-798\", \"description\": \"CWE-798 Hard-coded Credentials\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2024-04-11T09:44:24.119Z\", \"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\"}, \"references\": [{\"name\": \"VDB-259283 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials\", \"tags\": [\"vdb-entry\", \"technical-description\"], \"url\": \"https://vuldb.com/?id.259283\"}, {\"name\": \"VDB-259283 | CTI Indicators (IOB, IOC, TTP, IOA)\", \"tags\": [\"signature\", \"permissions-required\"], \"url\": \"https://vuldb.com/?ctiid.259283\"}, {\"tags\": [\"exploit\"], \"url\": \"https://github.com/netsecfish/dlink\"}, {\"tags\": [\"related\"], \"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383\"}], \"tags\": [\"unsupported-when-assigned\"], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-04-03T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-03T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2024-04-11T11:49:12.000Z\", \"value\": \"VulDB entry last update\"}], \"title\": \"D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials\"}}, \"cveMetadata\": {\"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"assignerShortName\": \"VulDB\", \"cveId\": \"CVE-2024-3272\", \"datePublished\": \"2024-04-04T01:00:05.740Z\", \"dateReserved\": \"2024-04-03T18:21:29.925Z\", \"dateUpdated\": \"2025-10-21T23:05:22.378Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2024-3272","id":5282,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.98109, \"percentile\": 0.99912}"},{"alert":0,"cve":"CVE-2024-3272","id":3064,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.98109, \"percentile\": 0.99912}"},{"alert":1,"cve":"CVE-2024-3272","id":671,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2024-3272\", \"cwes\": [\"CWE-798\"], \"dateAdded\": \"2024-04-11\", \"dueDate\": \"2024-05-02\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3272\", \"product\": \"Multiple NAS Devices\", \"requiredAction\": \"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.\", \"shortDescription\": \"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.\", \"vendorProject\": \"D-Link\", \"vulnerabilityName\": \"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability\"}"}],"record":{"affected":[{"modules":["HTTP GET Request Handler"],"product":"DNS-320L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-325","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-327L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-340L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]}],"cna":{"containers":{"adp":[{"affected":[{"cpes":["cpe:2.3:o:dlink:dns-320l_firmware:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"dns-320l_firmware","vendor":"dlink","versions":[{"status":"affected","version":"20240403"}]},{"cpes":["cpe:2.3:o:dlink:dns-325_firmware:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"dns-325_firmware","vendor":"dlink","versions":[{"status":"affected","version":"20240403"}]},{"cpes":["cpe:2.3:o:dlink:dns-327l_firmware:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"dns-327l_firmware","vendor":"dlink","versions":[{"status":"affected","version":"20240403"}]},{"cpes":["cpe:2.3:o:dlink:dns-340l_firmware:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"dns-340l_firmware","vendor":"dlink","versions":[{"status":"affected","version":"20240403"}]}],"metrics":[{"other":{"content":{"id":"CVE-2024-3272","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-04-12T04:00:39.050176Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2024-04-11","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2025-10-21T23:05:22.378Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272"}],"timeline":[{"lang":"en","time":"2024-04-11T00:00:00.000Z","value":"CVE-2024-3272 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-01T20:05:08.352Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"VDB-259283 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials","tags":["vdb-entry","technical-description","x_transferred"],"url":"https://vuldb.com/?id.259283"},{"name":"VDB-259283 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"],"url":"https://vuldb.com/?ctiid.259283"},{"tags":["exploit","x_transferred"],"url":"https://github.com/netsecfish/dlink"},{"tags":["related","x_transferred"],"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383"}],"title":"CVE Program Container"}],"cna":{"affected":[{"modules":["HTTP GET Request Handler"],"product":"DNS-320L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-325","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-327L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]},{"modules":["HTTP GET Request Handler"],"product":"DNS-340L","vendor":"D-Link","versions":[{"status":"affected","version":"20240403"}]}],"credits":[{"lang":"en","type":"finder","value":"netsecfish"}],"descriptions":[{"lang":"en","value":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced."},{"lang":"de","value":"Eine Schwachstelle wurde in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L bis 20240403 entdeckt. Sie wurde als sehr kritisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei /cgi-bin/nas_sharing.cgi der Komponente HTTP GET Request Handler. Mit der Manipulation des Arguments user mit der Eingabe messagebus mit unbekannten Daten kann eine hard-coded credentials-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"cvssV3_0":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}},{"cvssV2_0":{"baseScore":10,"vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-04-11T09:44:24.119Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-259283 | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/?id.259283"},{"name":"VDB-259283 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/?ctiid.259283"},{"tags":["exploit"],"url":"https://github.com/netsecfish/dlink"},{"tags":["related"],"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383"}],"tags":["unsupported-when-assigned"],"timeline":[{"lang":"en","time":"2024-04-03T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2024-04-03T02:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2024-04-11T11:49:12.000Z","value":"VulDB entry last update"}],"title":"D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials"}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2024-3272","datePublished":"2024-04-04T01:00:05.740Z","dateReserved":"2024-04-03T18:21:29.925Z","dateUpdated":"2025-10-21T23:05:22.378Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794219601,"cve":"CVE-2024-3272","description":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.","epss":{"date":"2026-11-12","epss":0.98109,"percentile":0.99912},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2024-3272","cwes":["CWE-798"],"dateAdded":"2024-04-11","dueDate":"2024-05-02","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383; https://nvd.nist.gov/vuln/detail/CVE-2024-3272","product":"Multiple NAS Devices","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","shortDescription":"D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.","vendorProject":"D-Link","vulnerabilityName":"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability"},"kev_checked":1794522003,"products":"D-Link DNS-320L, D-Link DNS-325, D-Link DNS-327L, D-Link DNS-340L","references":["https://vuldb.com/?id.259283","https://vuldb.com/?ctiid.259283","https://github.com/netsecfish/dlink","https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3272"],"score":{"baseScore":9.8,"baseSeverity":"CRITICAL","provider":"VulDB","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials","updated_at":1794500401,"workarounds":""},"sources":[]}