Description
D-Link DNS-320L, DNS-325, DNS-327L 与 DNS-340L中存在命令注入漏洞，此漏洞是由于未充分验证用户输入system的数据所导致的。
D-Link NAS nas_sharing.cgi 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://isms.csu.edu.tw/p/406-1147-14082,r22.php?Lang=zh-tw
https://www.sentinelone.com/vulnerability-database/cve-2024-3273/
https://nic.seu.edu.cn/info/1047/1255.htm
https://nvd.nist.gov/vuln/detail/cve-2024-3273
https://blog.csdn.net/qq_69775412/article/details/138335979
https://my.saintcorporation.com/cgi-bin/exploit_info/dlink_nas_sharing
https://www.techbang.com/posts/114354-affecting-92000-units-a-number-of-d-link-nas-devices-that
https://www.crowdsec.net/blog/exploit-attacks-dlink-nas-cve-2024-3273
https://github.com/passwa11/CVE-2024-3273
https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild
https://socradar.io/free-tools/cve-radar/CVE-2024-3273
https://isc.sans.edu/diary/31102
https://community.fortinet.com/fortindrcloud-59/fortiguard-outbreak-alert-d-link-multiple-devices-attack-176713
https://www.cyfirma.com/research/threat-actors-actively-exploiting-cve-2024-3273-underground-forums-share-ip-addresses-of-vulnerable-d-link-nas-devices/
https://sternumiot.com/iot-blog/d-link-multiple-nas-device-command-injection-and-sternum-protection/
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
https://vuldb.com/vuln/259284