CVE-2024-10914: D-Link NAS account_mgr.cgi OS command injection via name parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.2 with no authentication or interaction required, a public exploit, and an extremely high EPSS score make this an urgent risk despite high attack complexity and no vendor fix.

What it is

D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L NAS devices up to firmware 20241028 contain an OS command injection in the cgi_user_add function of /cgi-bin/account_mgr.cgi, reached through the name argument. The flaw is rated critical (CVSS 4.0 9.2) and a public exploit exists, so unpatched devices are at serious risk. D-Link has reportedly stated it will not fix the issue on these older models.

Impact

A remote attacker can execute arbitrary operating system commands on the NAS, leading to full compromise of the device and any data or credentials it holds. Because the device is a storage appliance, this can expose backups and shared files.

Attack surface

The vulnerability is network-reachable via HTTP requests to /cgi-bin/account_mgr.cgi with cmd=cgi_user_add, and the CVSS vector indicates no privileges (PR:N) and no user interaction (UI:N) are required. Attack complexity is rated high (AC:H), so exploitation depends on conditions such as reaching the management interface and crafting a valid request.

Exploitation

A public exploit has been disclosed and tagged as Exploit in the references, and EPSS is very high (0.96183, 99.876th percentile), indicating likely active exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Apply any vendor firmware update if one becomes available; D-Link has reportedly declined to fix these end-of-life models, so treat patching as unlikely.
• Isolate affected NAS devices from the internet and restrict management access to a trusted internal network or VPN.
• Disable or block access to /cgi-bin/account_mgr.cgi where feasible, and disable unused remote management features.
• Replace end-of-life DNS-320/320LW/325/340L units with supported hardware if they cannot be secured.
• Monitor and log HTTP requests to the CGI interface for suspicious name parameter values.

Detection

• Inspect web server or proxy logs for requests to /cgi-bin/account_mgr.cgi with cmd=cgi_user_add and shell metacharacters in the name parameter.
• Alert on unexpected outbound connections or process execution from NAS devices, which may indicate command injection success.
• Monitor for new or unexpected user accounts created on the NAS via the account manager interface.
• Watch for repeated or anomalous POST requests to the CGI endpoint from external or untrusted source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.