{"id":2998,"date":"2024-04-09T11:32:06","date_gmt":"2024-04-09T16:32:06","guid":{"rendered":"https:\/\/www.darkreading.com\/cloud-security\/92k-dlink-nas-critical-command-injection-bug"},"modified":"2024-04-09T11:32:06","modified_gmt":"2024-04-09T16:32:06","slug":"92k-d-link-nas-devices-open-to-critical-command-injection-bug","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/04\/09\/92k-d-link-nas-devices-open-to-critical-command-injection-bug\/","title":{"rendered":"92K D-Link NAS Devices Open to Critical Command-Injection Bug"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

A critical flaw in several end-of-life (EOL) models of <\/span>D-Link<\/a><\/span> network-attached storage (NAS) devices can allow attackers to backdoor the device and gain access to sensitive information, among other nefarious activities.<\/span><\/p>\n

More than 92,000 devices currently connected to the Internet are affected by a flaw tracked as <\/span>CVE-2024-3273<\/a><\/span> in D-Link NAS devices, including models DNS-340L, DNS-320L, DNS-327L, and DNS-325, according to D-Link. As a result, the company is asking customers to sunset any and all affected devices, which will remain vulnerable as the devices no longer receive updates or support from the vendor.<\/span><\/p>\n

A researcher who goes by the online name “netsecfish” identified the flaw and <\/span>detailed it<\/a><\/span> on GitHub and subsequently informed D-Link about it, which released <\/span>its own advisory.<\/a><\/span> The researcher also released an exploit for the flaw, in which attackers already are showing interest, according to <\/span>a post on X<\/a><\/span> (formerly Twitter) by Shadowserver.<\/span><\/p>\n

“We have started to see scans\/exploits from multiple IPs for CVE-2024-3273,” according to the post. “This involves chaining of a backdoor and command injection to achieve RCE.”<\/span><\/p>\n

Flaws in <\/span>NAS devices<\/a><\/span> are <\/span>serious business<\/a><\/span>, as exploiting them has great potential to affect not only the device itself but myriad devices that connect to it, posing a dangerous threat that can expose enterprise networks to risk.<\/span><\/p>\n

Data Theft, Denial of Service & More<\/h2>\n

The vulnerability exists in the nas_sharing.cgi CGI script, leading to backdooring through username and password exposure as well as command injection through the system parameter, explained netsecfish.<\/span><\/p>\n

“Affected is an unknown function of the file \/cgi-bin\/nas_sharing.cgi of the component HTTP GET Request Handler,” <\/span>according to the listing<\/a><\/span> for the flaw in the National Institute of Standards and Technology’s (NIST’s) National Vulnerability Database. “The manipulation of the argument system leads to command injection.”<\/span><\/p>\n

To get more granular, in terms of username and password exposure, the problem lies in the request, which<\/span> “<\/span><\/span>includes parameters for a username (user=messagebus) and an empty password field (passwd=),” according to netsecfish. “This indicates a backdoor allowing unauthorized access without proper authentication.”<\/span><\/p>\n

For command injection, attackers can exploit the “system” parameter within the request, “which carries a base64 encoded value that, when decoded, appears to be a command,” according to netsecfish.<\/span><\/p>\n

Attackers <\/span>can chain the two issues together<\/a><\/span> to obtain arbitrary command execution on the affected D-Link NAS devices, granting attackers potential access to sensitive information, system configuration alteration, or denial of service.<\/span><\/p>\n

Netsecfish’s exploit entails crafting malicious HTTP requests by preparing an HTTP GET request\u2013GET \/cgi-bin\/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=<BASE64_ENCODED_COMMAND_TO_BE_EXECUTED>\u2013targeting the \/cgi-bin\/nas_sharing.cgi endpoint.<\/span><\/p>\n

Replace & Retire Vulnerable D-Link Devices<\/h2>\n

A<\/span> report<\/a><\/span> published last year found that companies in every industry continue to <\/span>leave backup and storage platforms unsecured<\/a><\/span>, making it crucial for them to ensure cybercriminals can’t exploit vulnerable ones to enter corporate networks.<\/span><\/p>\n

With no forthcoming patch for CVE-2024-3273, the only true remedy is not to use affected devices at all, so anyone with one still connected to a network should retire and replace the product immediately, according to D-Link. A complete list of devices can be found in D-Link’s advisory.<\/span><\/p>\n

Indeed, the company remained adamant that it has no plans to support or update the affected products as per its typical device EOL strategy. “Regardless of product type or sales channel, D-Link’s general policy, when products reach EOS\/EOL, they can no longer be supported, and all firmware development for these products cease,” according to D-Link.<\/span><\/p>\n

If consumers in the US continue to use the device against the company’s recommendation, they should “please make sure the device has the last know firmware,” which can be located on a Legacy Website links included in the advisory, according to D-Link.<\/span><\/p>\n

Anyone who wants to continue using the device also should ensure frequent updating of the device’s unique password to access its Web configuration, as well enable Wi-Fi encryption with a unique password.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A critical flaw in several end-of-life (EOL) models of D-Link<\/p>\n","protected":false},"author":12,"featured_media":2999,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-2998","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=2560%2C1707&ssl=1",2560,1707,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=300%2C200&ssl=1",300,200,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=640%2C427&ssl=1",640,427,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=640%2C427&ssl=1",640,427,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=1536%2C1024&ssl=1",1536,1024,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=2048%2C1365&ssl=1",2048,1365,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=1024%2C683&ssl=1",1024,683,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/04\/92k-d-link-nas-devices-open-to-critical-command-injection-bug-scaled.jpg?fit=2560%2C1707&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2998"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2998\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/2999"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}