CVE-2024-3273: D-Link legacy NAS command injection in nas_sharing.cgi

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command injection with public exploit code, CISA KEV listing, near-maximum EPSS, and no vendor fix because the products are end-of-life.

What it is

An unauthenticated command injection flaw exists in the HTTP GET request handler of /cgi-bin/nas_sharing.cgi on multiple end-of-life D-Link NAS models, where manipulation of the 'system' argument allows arbitrary command execution. The affected products are no longer supported by the vendor, so no fix will be issued and the hardware should be retired. Public exploit code exists and the flaw is listed in CISA KEV, making it a high-value target for opportunistic scanning and compromise.

Impact

A remote attacker can execute arbitrary commands on the device, typically with root privileges, leading to full device compromise, data theft, or use as a foothold into the network. Because the devices are EOL, there is no vendor remediation path.

Attack surface

The flaw is reachable over the network via HTTP GET requests to /cgi-bin/nas_sharing.cgi; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required. Any internet-exposed or reachable instance of the affected NAS firmware is a candidate.

Exploitation

CVE-2024-3273 is in CISA KEV (added 2024-04-11) and has an EPSS 30-day probability of 0.99997, with public exploit code referenced in third-party advisories. Active exploitation in the wild has been reported.

What to do

• Retire and replace affected end-of-life D-Link NAS devices per vendor guidance; no patch will be released.
• Immediately remove any affected device from internet exposure and block inbound access to /cgi-bin/nas_sharing.cgi at the perimeter.
• Isolate remaining legacy NAS devices on a segmented VLAN with strict egress and lateral-movement controls.
• Monitor vendor and CISA KEV guidance for any updated retirement or replacement instructions.
• If devices cannot be removed, restrict management and data access to trusted hosts only and log all HTTP requests to the CGI interface.

Detection

• Alert on HTTP GET requests to /cgi-bin/nas_sharing.cgi, especially those containing shell metacharacters or the 'system' parameter.
• Monitor for unexpected outbound connections or command-and-control traffic originating from NAS device IPs.
• Review device logs and network flow data for anomalous process execution or file writes on affected NAS units.
• Hunt for known exploit payload patterns from public PoCs against the nas_sharing.cgi endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.