CVE-2024-3272

A hard-coded 'messagebus' account (CWE-798) in the HTTP GET request handler of /cgi-bin/nas_sharing.cgi on D-Link NAS devices lets a remote, unauthenticated attacker authenticate as a backdoor user by sending a crafted request with user=messagebus. Successful use of the backdoor grants full unauthorized access to the device's management/sharing interface (CVSS 9.8: network-exploitable, low complexity, no privileges or user interaction required). Affected devices are end-of-life D-Link NAS models — including DNS-320L, DNS-320, DNS-320LW, DNS-321, DNS-323, DNS-325, DNS-326, DNS-327L, DNS-340L, DNS-120, DNS-315L, DNR-202L and DNR-322L — which will never receive a fixed firmware release. The exploit is public, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-04-11, EPSS stands at 98%, and press reports indicate a botnet is actively targeting these devices. Roughly 92,000 internet-facing D-Link NAS devices are estimated to be exposed.

What to do: These products are end-of-life and will not be patched, so retire and replace them per D-Link's guidance. In the interim, remove any port-forwarding or remote-access rules that expose the NAS web interface (nas_sharing.cgi) to the internet and verify the backdoor 'messagebus' account cannot authenticate. Since active exploitation (including botnet deployment) is underway, check any previously exposed device for signs of compromise such as unknown accounts or unusual processes.