CVE-2024-3272CISA KEV: Actively Exploited

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

Published Apr 11, 2024·Updated Apr 11, 2024

Description

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.

Public Exploits & PoCs2 found

PoC: dinkleberry

Patch your D-Link device affected by CVE-2024-3272

PoC: D-Link-NAS-Devices-Unauthenticated-RCE

UNTESTED exploit script for CVE-2024-3272 + CVE-2024-3273. The script exploits a backdoor authentication bypass + arbitrary command injection vulnerability.

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free