CVE-2024-3273 in dlink dns-320l firmware
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Affected software: dlink dns-320l firmware, dlink dns-120 firmware, dlink dnr-202l firmware, dlink dns-315l firmware, dlink dns-320 firmware, dlink dns-320lw firmware, dlink dns-321 firmware, dlink dnr-322l firmware, dlink dns-323 firmware, dlink dns-325 firmware
Scores
- CVSS: 9.8 (critical)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2024-04-11
- Published: 2024-04-04
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.