High 7.3Known exploited (CISA KEV)Published Apr 3, 2024

CVE-2024-3273D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

Updated under an hour ago (Oct 27, 2026, 5:30 AM ET)

Does this affect you?

It affects D-Link DNS-320L and 23 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Apr 11, 2024; federal agencies had to remediate by May 2, 2024. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for D-Link DNS-320L

Exploited in the last 30 days

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-77
Known exploited: Added to CISA KEV Apr 11, 2024; federal remediation due May 2, 2024This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
EPSS (exploitation in the next 30 days): 100.00% (percentile 100)
Assigned by: VulDB
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

D-Link DNS-320L d_link:dns_320l (from the name)	20240403	CNA record
D-Link DNS-325 d_link:dns_325 (from the name)	20240403	CNA record
D-Link DNS-327L d_link:dns_327l (from the name)	20240403	CNA record
D-Link DNS-340L d_link:dns_340l (from the name)	20240403	CNA record
dlink dns-320l_firmware dlink:dns-320l_firmware	20240403	CISA ADP
dlink dns-325_firmware dlink:dns-325_firmware	20240403	CISA ADP
dlink dns-327l_firmware dlink:dns-327l_firmware	20240403	CISA ADP
dlink dns-340l_firmware dlink:dns-340l_firmware	20240403	CISA ADP
dlink dns-320l_firmware dlink:dns-320l_firmware	1.01.0702.2013; 1.03.0904.2013; 1.11	NVD
dlink dns-120_firmware dlink:dns-120_firmware	all versions	NVD
1–10 of 28

References

References

https://vuldb.com/?id.259284	vdb-entry, technical-description, third-party-advisory
https://vuldb.com/?ctiid.259284	signature, permissions-required, vdb-entry
https://vuldb.com/?submit.304661	third-party-advisory, vdb-entry
https://github.com/netsecfish/dlink	exploit, third-party-advisory
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383	related, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3273	us-government-resource
https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.