# CVE-2024-3273: D-Link Multiple NAS Devices Command Injection Vulnerability

- Exploited (CISA KEV): yes, added 2024-04-11
- Published: 2024-04-04
- CVSS: 7.3 HIGH (v3.1)
- EPSS: 100.0% (100th percentile)
- CWE: CWE-77

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2024-3273, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-3273, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-3273 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-3273