Research · Apr 3, 2024 · ZeroDay Catalog
Critical Command Injection Vulnerability in D-Link NAS Devices
A critical command injection vulnerability has been identified in several D-Link NAS devices, affecting unsupported models and allowing for remote exploitation.
What changed
A critical command injection vulnerability has been discovered in multiple D-Link NAS devices, specifically in the HTTP GET Request Handler of the file /cgi-bin/nas_sharing.cgi. This vulnerability allows attackers to manipulate the 'system' argument, potentially leading to unauthorized command execution.
The vulnerability has been publicly disclosed, increasing the risk of exploitation by malicious actors.
Who is affected
The following D-Link NAS devices are affected by this vulnerability:
1. D-Link DNS-320L 2. D-Link DNS-325 3. D-Link DNS-327L 4. D-Link DNS-340L
- D-Link DNS-320L
- D-Link DNS-325
- D-Link DNS-327L
- D-Link DNS-340L
What to do
Given that the affected devices are no longer supported by D-Link, immediate remediation options are limited. Users of these devices should consider the following actions:
1. Isolate affected devices from the network to prevent unauthorized access. 2. Evaluate the need for replacement with supported models that receive regular security updates. 3. Monitor network traffic for any suspicious activity related to these devices.