How to find D-Link NAS Storage devices


D-Link has disclosed multiple vulnerabilities in their D-Link NAS Storage products.

CVE-2024-3273 is rated high with CVSS score of 7.3 and allows an attacker to manipulate HTTP GET request arguments which can lead to remote command injection and execution.

What is the impact? #

This vulnerability impacts all DNS-340L, DNS-320L, DNS-327L, and DNS-325 network attached storage models. The vulnerabilities report is a Command Injection and Backdoor Account attack for the devices web management interface allowing a malicious user to exploit the devices.

Are updates or workarounds available? #

D-Link identified these devices as End of Life ("EOL")/End of Service Life ("EOS") Life-Cycle and will not receive updates. D-Link recommends these devices be replaced. If they cannot be replaced, then it is recommended that these devices be firewalled off from the public internet to disallow remote access from any other network.

How do I find potentially vulnerable systems with runZero? #

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

(vendor:="D-Link" AND product:="DNS%") OR (name:="DNS-340L%" OR name:="DNS-320L%" OR name:="DNS-327L%" OR name:="DNS-325%")

Written by Blain Smith

Blain Smith is a Security Research Engineer at runZero. He spent most of his career in cloud and distributed systems for AAA gaming, entertainment, and networking working on some of the most popular games and systems millions of people play and watch daily. He has given numerous talks conferences such as TEDx, GopherCon, and P99CONF. His shift into infosec has afforded him the ability to apply his distributed systems and networking knowledge to other industries such as IoT and OT.

More about Blain Smith
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Rapid Response
How to find Palo Alto Network firewalls running PAN-OS 11.1, 11.0, and 10.2
Palo Alto Networks disclosed that versions of their PAN-OS software have a vulnerability allowing for remote command injection. Here's how to find...
Rapid Response
How to find CrushFTP services
CrushFTP disclosed that versions of their file transfer software have a vulnerability allowing unauthenticated file system access. Here's how to...
Rapid Response
How to find outdated lighttpd services
Outdated versions of the open source lighttpd web server are vulnerable to a handful of security vulnerabilities
Rapid Response
How to find Brocade Fabric OS
On April 4, 2024, Broadcom disclosed a vulnerability in their Fabric OS operating system used in their Brocade storage networking devices. Here's...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved