Summary: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two known exploited vulnerabilities in D-Link multiple NAS devices to its catalog.
Threat Actor: N/A
Victim: D-Link Multiple NAS Devices
Key Point :
- CVE-2024-3272 is a Use of Hard-Coded Credentials Vulnerability that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
- CVE-2024-3273 is a Command Injection Vulnerability that allows an attacker to achieve remote, unauthorized code execution by chaining it with CVE-2024-3272.
- D-Link products affected by these vulnerabilities should be retired and replaced per vendor instructions.
- Federal agencies are ordered to fix this vulnerability by May 2, 2024, according to CISA’s Binding Operational Directive (BOD) 22-01.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following D-Link multiple NAS devices flaws to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2024-3272 D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
- CVE-2024-3273 D-Link Multiple NAS Devices Command Injection Vulnerability
The flaw CVE-2024-3272 is a Use of Hard-Coded Credentials Vulnerability impacting D-Link Multiple NAS Devices. The flaw affects D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L, these devices
The flaw CVE-2024-3272 is a Command Injection Vulnerability impacting D-Link Multiple NAS Devices. The vulnerability impacts D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L, which contain a command injection vulnerability. Chaining CVE-2024-3272 and CVE-2024-3273 an attacker can achieve remote, unauthorized code execution.
This flaw also affects D-Link products that have reached their end-of-life (EOL) or end-of-service (EOS) life cycle, for this reason, they should be retired and replaced per vendor instructions.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by May 2, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – Hacking, CISA)
“An interesting youtube video that may be related to the article above”