CVE-2024-3273

A critical vulnerability has been identified in several models of D-Link network-attached storage devices, specifically affecting the HTTP GET request handler within the file responsible for NAS sharing functionalities. The flaw arises from improper handling of user-supplied input, allowing an attacker to manipulate the "system" argument, which can lead to command injection. This type of vulnerability is particularly dangerous as it enables an attacker to execute arbitrary commands on the affected device, potentially compromising the entire system. The severity of this issue is underscored by its high CVSS score, indicating a significant risk to users of these devices.

Exploitation of this vulnerability can occur remotely, meaning that an attacker does not need physical access to the device to launch an attack. By crafting a malicious HTTP request that targets the vulnerable endpoint, an attacker can execute arbitrary commands with the same privileges as the web server process. This could lead to unauthorized access to sensitive data, manipulation of device settings, or even the installation of malware. Given that the affected products are no longer supported by the vendor, users are left without any official patches or mitigations, increasing the urgency for immediate action.

The real-world impact of this vulnerability is substantial, particularly for businesses that rely on these devices for data storage and sharing. Compromised devices could lead to data breaches, loss of intellectual property, and significant reputational damage. Furthermore, the potential for lateral movement within a network could allow attackers to target other connected systems, amplifying the risk. For organizations that handle sensitive information, the consequences of a successful exploit could result in regulatory fines and legal liabilities, making the business risk associated with this vulnerability particularly high.

To detect and mitigate this vulnerability, organizations should first conduct an inventory of their network-attached storage devices to identify any affected models. Regular security assessments and penetration testing can help uncover potential exploitation paths. Given the lack of vendor support, organizations should consider implementing network segmentation to isolate vulnerable devices from critical systems. Additionally, employing intrusion detection systems (IDS) can help monitor for unusual traffic patterns indicative of exploitation attempts. Ultimately, the most effective long-term strategy is to replace unsupported devices with newer models that receive regular security updates, thereby reducing exposure to known vulnerabilities.

In conclusion, the critical vulnerability in D-Link network-attached storage devices poses a significant threat to both individuals and organizations. The potential for remote command injection, coupled with the lack of vendor support, necessitates immediate action from users to mitigate risks. By implementing detection strategies and prioritizing the replacement of vulnerable devices, organizations can better protect their networks from exploitation and safeguard sensitive data against unauthorized access.

Recent updates to CVE-2024-3273 reveal a downward revision of the CVSS score from critical (9.8) to high (7.3), reflecting a reassessment of the vulnerability’s impact and exploitability. Despite this reduction, our telemetry indicates a significant decline in detection activity across monitored environments, suggesting either a waning attacker focus or improved defensive postures. Concurrently, the exploit landscape has broadened with the emergence of new proof-of-concept tools publicly available on multiple platforms, which could lower the barrier for threat actors to weaponize this vulnerability. The EPSS score remains persistently high and stable, indicating sustained potential for exploitation in the wild. For defenders, this nuanced shift underscores a complex risk environment: while active exploitation signals have diminished, the accessibility of new exploit code maintains a latent threat that could be rapidly leveraged if conditions change. Consequently, the overall threat level remains elevated, warranting continued vigilance despite the CVSS downgrade, as the vulnerability still poses a credible risk of remote command injection with potential operational impact.

Update 2 — June 09, 2026

CSURFACE threat intelligence has identified a recalibration of the CVSS score for CVE-2024-3273 from 7.3 to 9.8, reflecting a reassessment of its criticality based on evolving technical insights and exploitability factors. Despite this upward revision in severity, our telemetry indicates a significant reduction in active exploitation attempts, suggesting that threat actors may be deprioritizing this vector or encountering operational challenges in leveraging it at scale. Concurrently, the EPSS score remains persistently high and stable, underscoring the sustained potential for exploitation given the availability of multiple new proof-of-concept exploits circulating in public repositories. This dichotomy between diminished detection signals and the proliferation of exploit code highlights a latent but credible risk environment. For defenders, this means that while immediate exploitation pressure appears to have eased, the vulnerability’s critical rating and accessible exploit tools maintain a high threat level that could be rapidly activated under favorable attacker conditions. The updated risk assessment thus elevates the urgency of monitoring and preparedness, as the vulnerability continues to represent a significant remote command injection risk with potential operational impact.

Update 3 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2024-3273, reflected by a notable surge in telemetry signals and an increase in the Exploit Prediction Scoring System (EPSS) score to its maximum value. This upward trend underscores a growing attacker interest and operational momentum, likely fueled by the continued availability of multiple high-profile proof-of-concept exploits circulating on public repositories. The convergence of increased detection activity and elevated EPSS metrics signals that adversaries are actively refining and deploying attack vectors against vulnerable D-Link NAS devices. For defenders, this shift elevates the immediacy of the threat, as the vulnerability’s critical severity combined with expanding exploit accessibility significantly raises the probability of successful remote command injection attacks. Consequently, the threat level for CVE-2024-3273 should be considered heightened, reflecting an environment where exploitation attempts are becoming more frequent and potentially more effective.

Update 4 — July 07, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-3273, accompanied by the emergence of multiple new proof-of-concept exploits circulating on public code repositories. This development indicates that threat actors are actively refining their attack methodologies, increasing the sophistication and accessibility of remote command injection techniques against vulnerable D-Link NAS devices. Our telemetry shows that while the overall exploit trend remains stable, the qualitative increase in detection frequency and exploit variety signals a broadening attacker interest and capability. This intensifies the operational risk for defenders, as the expanding exploit toolkit lowers the barrier to entry for less skilled adversaries and raises the likelihood of successful compromise. Consequently, the threat level for CVE-2024-3273 should be elevated to reflect a heightened state of exploitation readiness and increased adversary engagement in the wild.