Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2024-3273 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Dns-320L Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A critical command injection vulnerability (CWE-77) exists in the HTTP GET request handler of the file /cgi-bin/nas_sharing.cgi on D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L devices up to version 20240403. The flaw is triggered by unsanitized input to the system argument and permits unauthenticated remote attackers to execute arbitrary commands. The affected products are end-of-life, carry an “unsupported when assigned” status, and have no vendor fixes available.
An attacker with network access can send a crafted GET request to the CGI endpoint and obtain limited read, write, and execution capabilities on the device. Public exploit code has been released, and the issue can be triggered without user interaction or credentials, consistent with its CVSS 7.3 rating.
D-Link’s security advisory SAP10383 and associated vendor statements confirm the products are no longer supported and explicitly recommend retirement and replacement. No patches or mitigations are provided for these discontinued models. The associated EPSS score of 0.9443 indicates sustained public interest in exploitation since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31863
Vulnerability Data
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler.…
more
The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- CWE(s)
- KEV Date Added
- 11 April 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.3V1.2.5V1.2.8V1.2.9
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover command-construction flaws before deployment.
Input validation directly stops construction of commands from untrusted data containing special elements.
Secure engineering principles include proper neutralization and safe command construction practices.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and neutralization that prevent command injection.
Runtime monitoring of software and data can detect anomalous command execution resulting from injection.
Identifying recorded vulnerabilities enables remediation of command-injection flaws before exploitation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.
Security testing in development catches command-injection vulnerabilities before release.
Secure development life cycle mandates input validation and command construction practices that directly prevent command injection.
Application security requirements explicitly call for controls against injection flaws including command injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Environment separation limits the blast radius of an exploited command injection but does not prevent the flaw itself.