CVE-2024-3272: D-Link NAS Devices Hard-Coded Credentials in nas_sharing.cgi

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, near-certain EPSS score and a public exploit against unsupported devices with no vendor patch make this an immediate remediation priority.

What it is

D-Link DNS and DNR series NAS devices contain hard-coded credentials reachable through the HTTP GET handler in /cgi-bin/nas_sharing.cgi, where the 'user' argument accepts the value 'messagebus'. The flaw is rated CVSS 9.8 and affects products that are end-of-life and no longer supported by the vendor. Because the credentials are fixed and publicly documented, any reachable device is effectively open to unauthenticated compromise.

Impact

An attacker gains unauthenticated remote access to the device with the privileges tied to the hard-coded account, enabling full compromise of confidentiality, integrity and availability. On a NAS this typically means access to stored data and the ability to alter device behavior.

Attack surface

Reachable over the network via HTTP GET requests to /cgi-bin/nas_sharing.cgi; the CVSS vector shows no privileges and no user interaction required. Any device exposing this CGI endpoint to an untrusted network is exposed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-04-11, and EPSS gives a 30-day exploitation probability of 0.98038 (99.9th percentile). A public exploit is referenced, so active exploitation should be assumed.

What to do

• Retire and replace affected end-of-life D-Link DNS/DNR devices; the vendor states no fix will be provided.
• If retirement is not immediate, remove the devices from internet exposure and restrict management and CGI access to a trusted internal network only.
• Block or filter access to /cgi-bin/nas_sharing.cgi at the network perimeter and on internal segmentation boundaries.
• Monitor vendor advisory SAP10383 for any updated guidance and track CISA KEV remediation deadlines.
• Inventory all listed DNS and DNR models on the network so unmanaged units are not overlooked.

Detection

• Search web/proxy logs for GET requests to /cgi-bin/nas_sharing.cgi, especially with a user parameter value of messagebus.
• Alert on inbound connections to NAS management or CGI ports from outside expected internal ranges.
• Monitor for authentication or configuration changes on D-Link NAS devices that do not correspond to known administrative activity.
• Use network discovery to flag any of the affected DNS/DNR models still responding on the network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.